code:
/*-
 * Copyright (c) 2005-2009 Apple Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in the
 *     documentation and/or other materials provided with the distribution.
 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 *     its contributors may be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_kevents.h#7
 * $FreeBSD: release/9.0.0/sys/bsm/audit_kevents.h 197624 2009-09-29 21:25:59Z rwatson $
 */

#ifndef _BSM_AUDIT_KEVENTS_H_
#define	_BSM_AUDIT_KEVENTS_H_

/*
 * The reserved event numbers for kernel events are 1...2047 and 43001..44900.
 */
#define	AUE_IS_A_KEVENT(e)	(((e) > 0 && (e) < 2048) || 	\
    				 ((e) > 43000 && (e) < 45000))

/*
 * Values marked as AUE_NULL are not required to be audited as per CAPP.
 *
 * Some conflicts exist in the assignment of name to event number mappings
 * between BSM implementations.  In general, we prefer the OpenSolaris
 * definition as we consider Solaris BSM to be authoritative.  _DARWIN_ has
 * been inserted for the Darwin variants.  If necessary, other tags will be
 * added in the future.
 */
#define	AUE_NULL		0
#define	AUE_EXIT		1
#define	AUE_FORK		2
#define	AUE_FORKALL		AUE_FORK	/* Solaris-specific. */
#define	AUE_OPEN		3
#define	AUE_CREAT		4
#define	AUE_LINK		5
#define	AUE_UNLINK		6
#define	AUE_DELETE		AUE_UNLINK	/* Darwin-specific. */
#define	AUE_EXEC		7
#define	AUE_CHDIR		8
#define	AUE_MKNOD		9
#define	AUE_CHMOD		10
#define	AUE_CHOWN		11
#define	AUE_UMOUNT		12
#define	AUE_JUNK		13	/* Solaris-specific. */
#define	AUE_ACCESS		14
#define	AUE_KILL		15
#define	AUE_STAT		16
#define	AUE_LSTAT		17
#define	AUE_ACCT		18
#define	AUE_MCTL		19	/* Solaris-specific. */
#define	AUE_REBOOT		20	/* XXX: Darwin conflict. */
#define	AUE_SYMLINK		21
#define	AUE_READLINK		22
#define	AUE_EXECVE		23
#define	AUE_CHROOT		24
#define	AUE_VFORK		25
#define	AUE_SETGROUPS		26
#define	AUE_SETPGRP		27
#define	AUE_SWAPON		28
#define	AUE_SETHOSTNAME		29	/* XXX: Darwin conflict. */
#define	AUE_FCNTL		30
#define	AUE_SETPRIORITY		31	/* XXX: Darwin conflict. */
#define	AUE_CONNECT		32
#define	AUE_ACCEPT		33
#define	AUE_BIND		34
#define	AUE_SETSOCKOPT		35
#define	AUE_VTRACE		36	/* Solaris-specific. */
#define	AUE_SETTIMEOFDAY	37	/* XXX: Darwin conflict. */
#define	AUE_FCHOWN		38
#define	AUE_FCHMOD		39
#define	AUE_SETREUID		40
#define	AUE_SETREGID		41
#define	AUE_RENAME		42
#define	AUE_TRUNCATE		43	/* XXX: Darwin conflict. */
#define	AUE_FTRUNCATE		44	/* XXX: Darwin conflict. */
#define	AUE_FLOCK		45	/* XXX: Darwin conflict. */
#define	AUE_SHUTDOWN		46
#define	AUE_MKDIR		47
#define	AUE_RMDIR		48
#define	AUE_UTIMES		49
#define	AUE_ADJTIME		50
#define	AUE_SETRLIMIT		51
#define	AUE_KILLPG		52
#define	AUE_NFS_SVC		53	/* XXX: Darwin conflict. */
#define	AUE_STATFS		54
#define	AUE_FSTATFS		55
#define	AUE_UNMOUNT		56	/* XXX: Darwin conflict. */
#define	AUE_ASYNC_DAEMON	57
#define	AUE_NFS_GETFH		58	/* XXX: Darwin conflict. */
#define	AUE_SETDOMAINNAME	59
#define	AUE_QUOTACTL		60	/* XXX: Darwin conflict. */
#define	AUE_EXPORTFS		61
#define	AUE_MOUNT		62
#define	AUE_SEMSYS		63
#define	AUE_MSGSYS		64
#define	AUE_SHMSYS		65
#define	AUE_BSMSYS		66	/* Solaris-specific. */
#define	AUE_RFSSYS		67	/* Solaris-specific. */
#define	AUE_FCHDIR		68
#define	AUE_FCHROOT		69
#define	AUE_VPIXSYS		70	/* Solaris-specific. */
#define	AUE_PATHCONF		71
#define	AUE_OPEN_R		72
#define	AUE_OPEN_RC		73
#define	AUE_OPEN_RT		74
#define	AUE_OPEN_RTC		75
#define	AUE_OPEN_W		76
#define	AUE_OPEN_WC		77
#define	AUE_OPEN_WT		78
#define	AUE_OPEN_WTC		79
#define	AUE_OPEN_RW		80
#define	AUE_OPEN_RWC		81
#define	AUE_OPEN_RWT		82
#define	AUE_OPEN_RWTC		83
#define	AUE_MSGCTL		84
#define	AUE_MSGCTL_RMID		85
#define	AUE_MSGCTL_SET		86
#define	AUE_MSGCTL_STAT		87
#define	AUE_MSGGET		88
#define	AUE_MSGRCV		89
#define	AUE_MSGSND		90
#define	AUE_SHMCTL		91
#define	AUE_SHMCTL_RMID		92
#define	AUE_SHMCTL_SET		93
#define	AUE_SHMCTL_STAT		94
#define	AUE_SHMGET		95
#define	AUE_SHMAT		96
#define	AUE_SHMDT		97
#define	AUE_SEMCTL		98
#define	AUE_SEMCTL_RMID		99
#define	AUE_SEMCTL_SET		100
#define	AUE_SEMCTL_STAT		101
#define	AUE_SEMCTL_GETNCNT	102
#define	AUE_SEMCTL_GETPID	103
#define	AUE_SEMCTL_GETVAL	104
#define	AUE_SEMCTL_GETALL	105
#define	AUE_SEMCTL_GETZCNT	106
#define	AUE_SEMCTL_SETVAL	107
#define	AUE_SEMCTL_SETALL	108
#define	AUE_SEMGET		109
#define	AUE_SEMOP		110
#define	AUE_CORE		111	/* Solaris-specific, currently. */
#define	AUE_CLOSE		112
#define	AUE_SYSTEMBOOT		113	/* Solaris-specific. */
#define	AUE_ASYNC_DAEMON_EXIT	114	/* Solaris-specific. */
#define	AUE_NFSSVC_EXIT		115	/* Solaris-specific. */
#define	AUE_WRITEL		128	/* Solaris-specific. */
#define	AUE_WRITEVL		129	/* Solaris-specific. */
#define	AUE_GETAUID		130
#define	AUE_SETAUID		131
#define	AUE_GETAUDIT		132
#define	AUE_SETAUDIT		133
#define	AUE_GETUSERAUDIT	134	/* Solaris-specific. */
#define	AUE_SETUSERAUDIT	135	/* Solaris-specific. */
#define	AUE_AUDITSVC		136	/* Solaris-specific. */
#define	AUE_AUDITUSER		137	/* Solaris-specific. */
#define	AUE_AUDITON		138
#define	AUE_AUDITON_GTERMID	139	/* Solaris-specific. */
#define	AUE_AUDITON_STERMID	140	/* Solaris-specific. */
#define	AUE_AUDITON_GPOLICY	141
#define	AUE_AUDITON_SPOLICY	142
#define	AUE_AUDITON_GQCTRL	145
#define	AUE_AUDITON_SQCTRL	146
#define	AUE_GETKERNSTATE	147	/* Solaris-specific. */
#define	AUE_SETKERNSTATE	148	/* Solaris-specific. */
#define	AUE_GETPORTAUDIT	149	/* Solaris-specific. */
#define	AUE_AUDITSTAT		150	/* Solaris-specific. */
#define	AUE_REVOKE		151
#define	AUE_MAC			152	/* Solaris-specific. */
#define	AUE_ENTERPROM		153	/* Solaris-specific. */
#define	AUE_EXITPROM		154	/* Solaris-specific. */
#define	AUE_IFLOAT		155	/* Solaris-specific. */
#define	AUE_PFLOAT		156	/* Solaris-specific. */
#define	AUE_UPRIV		157	/* Solaris-specific. */
#define	AUE_IOCTL		158
#define	AUE_SOCKET		183
#define	AUE_SENDTO		184
#define	AUE_PIPE		185
#define	AUE_SOCKETPAIR		186	/* XXX: Darwin conflict. */
#define	AUE_SEND		187
#define	AUE_SENDMSG		188
#define	AUE_RECV		189
#define	AUE_RECVMSG		190
#define	AUE_RECVFROM		191
#define	AUE_READ		192
#define	AUE_GETDENTS		193
#define	AUE_LSEEK		194
#define	AUE_WRITE		195
#define	AUE_WRITEV		196
#define	AUE_NFS			197	/* Solaris-specific. */
#define	AUE_READV		198
#define	AUE_OSTAT		199	/* Solaris-specific. */
#define	AUE_SETUID		200	/* XXXRW: Solaris old setuid? */
#define	AUE_STIME		201	/* XXXRW: Solaris old stime? */
#define	AUE_UTIME		202	/* XXXRW: Solaris old utime? */
#define	AUE_NICE		203	/* XXXRW: Solaris old nice? */
#define	AUE_OSETPGRP		204	/* Solaris-specific. */
#define	AUE_SETGID		205
#define	AUE_READL		206	/* Solaris-specific. */
#define	AUE_READVL		207	/* Solaris-specific. */
#define	AUE_FSTAT		208
#define	AUE_DUP2		209
#define	AUE_MMAP		210
#define	AUE_AUDIT		211
#define	AUE_PRIOCNTLSYS		212	/* Solaris-specific. */
#define	AUE_MUNMAP		213
#define	AUE_SETEGID		214
#define	AUE_SETEUID		215
#define	AUE_PUTMSG		216	/* Solaris-specific. */
#define	AUE_GETMSG		217	/* Solaris-specific. */
#define	AUE_PUTPMSG		218	/* Solaris-specific. */
#define	AUE_GETPMSG		219	/* Solaris-specific. */
#define	AUE_AUDITSYS		220	/* Solaris-specific. */
#define	AUE_AUDITON_GETKMASK	221
#define	AUE_AUDITON_SETKMASK	222
#define	AUE_AUDITON_GETCWD	223
#define	AUE_AUDITON_GETCAR	224
#define	AUE_AUDITON_GETSTAT	225
#define	AUE_AUDITON_SETSTAT	226
#define	AUE_AUDITON_SETUMASK	227
#define	AUE_AUDITON_SETSMASK	228
#define	AUE_AUDITON_GETCOND	229
#define	AUE_AUDITON_SETCOND	230
#define	AUE_AUDITON_GETCLASS	231
#define	AUE_AUDITON_SETCLASS	232
#define	AUE_FUSERS		233	/* Solaris-specific; also UTSSYS? */
#define	AUE_STATVFS		234
#define	AUE_XSTAT		235	/* Solaris-specific. */
#define	AUE_LXSTAT		236	/* Solaris-specific. */
#define	AUE_LCHOWN		237
#define	AUE_MEMCNTL		238	/* Solaris-specific. */
#define	AUE_SYSINFO		239	/* Solaris-specific. */
#define	AUE_XMKNOD		240	/* Solaris-specific. */
#define	AUE_FORK1		241
#define	AUE_MODCTL		242	/* Solaris-specific. */
#define	AUE_MODLOAD		243
#define	AUE_MODUNLOAD		244
#define	AUE_MODCONFIG		245	/* Solaris-specific. */
#define	AUE_MODADDMAJ		246	/* Solaris-specific. */
#define	AUE_SOCKACCEPT		247	/* Solaris-specific. */
#define	AUE_SOCKCONNECT		248	/* Solaris-specific. */
#define	AUE_SOCKSEND		249	/* Solaris-specific. */
#define	AUE_SOCKRECEIVE		250	/* Solaris-specific. */
#define	AUE_ACLSET		251
#define	AUE_FACLSET		252
#define	AUE_DOORFS		253	/* Solaris-specific. */
#define	AUE_DOORFS_DOOR_CALL	254	/* Solaris-specific. */
#define	AUE_DOORFS_DOOR_RETURN	255	/* Solaris-specific. */
#define	AUE_DOORFS_DOOR_CREATE	256	/* Solaris-specific. */
#define	AUE_DOORFS_DOOR_REVOKE	257	/* Solaris-specific. */
#define	AUE_DOORFS_DOOR_INFO	258	/* Solaris-specific. */
#define	AUE_DOORFS_DOOR_CRED	259	/* Solaris-specific. */
#define	AUE_DOORFS_DOOR_BIND	260	/* Solaris-specific. */
#define	AUE_DOORFS_DOOR_UNBIND	261	/* Solaris-specific. */
#define	AUE_P_ONLINE		262	/* Solaris-specific. */
#define	AUE_PROCESSOR_BIND	263	/* Solaris-specific. */
#define	AUE_INST_SYNC		264	/* Solaris-specific. */
#define	AUE_SOCKCONFIG		265	/* Solaris-specific. */
#define	AUE_SETAUDIT_ADDR	266
#define	AUE_GETAUDIT_ADDR	267
#define	AUE_UMOUNT2		268	/* Solaris-specific. */
#define	AUE_FSAT		269	/* Solaris-specific. */
#define	AUE_OPENAT_R		270
#define	AUE_OPENAT_RC		271
#define	AUE_OPENAT_RT		272
#define	AUE_OPENAT_RTC		273
#define	AUE_OPENAT_W		274
#define	AUE_OPENAT_WC		275
#define	AUE_OPENAT_WT		276
#define	AUE_OPENAT_WTC		277
#define	AUE_OPENAT_RW		278
#define	AUE_OPENAT_RWC		279
#define	AUE_OPENAT_RWT		280
#define	AUE_OPENAT_RWTC		281
#define	AUE_RENAMEAT		282
#define	AUE_FSTATAT		283
#define	AUE_FCHOWNAT		284
#define	AUE_FUTIMESAT		285
#define	AUE_UNLINKAT		286
#define	AUE_CLOCK_SETTIME	287
#define	AUE_NTP_ADJTIME		288
#define	AUE_SETPPRIV		289	/* Solaris-specific. */
#define	AUE_MODDEVPLCY		290	/* Solaris-specific. */
#define	AUE_MODADDPRIV		291	/* Solaris-specific. */
#define	AUE_CRYPTOADM		292	/* Solaris-specific. */
#define	AUE_CONFIGKSSL		293	/* Solaris-specific. */
#define	AUE_BRANDSYS		294	/* Solaris-specific. */
#define	AUE_PF_POLICY_ADDRULE	295	/* Solaris-specific. */
#define	AUE_PF_POLICY_DELRULE	296	/* Solaris-specific. */
#define	AUE_PF_POLICY_CLONE	297	/* Solaris-specific. */
#define	AUE_PF_POLICY_FLIP	298	/* Solaris-specific. */
#define	AUE_PF_POLICY_FLUSH	299	/* Solaris-specific. */
#define	AUE_PF_POLICY_ALGS	300	/* Solaris-specific. */
#define	AUE_PORTFS		301	/* Solaris-specific. */

/*
 * Events added for Apple Darwin that potentially collide with future Solaris
 * BSM events.  These are assigned AUE_DARWIN prefixes, and are deprecated in
 * new trails.  Systems generating these events should switch to the new
 * identifiers that avoid colliding with the Solaris identifier space.
 */
#define	AUE_DARWIN_GETFSSTAT	301
#define	AUE_DARWIN_PTRACE	302
#define	AUE_DARWIN_CHFLAGS	303
#define	AUE_DARWIN_FCHFLAGS	304
#define	AUE_DARWIN_PROFILE	305
#define	AUE_DARWIN_KTRACE	306
#define	AUE_DARWIN_SETLOGIN	307
#define	AUE_DARWIN_REBOOT	308
#define	AUE_DARWIN_REVOKE	309
#define	AUE_DARWIN_UMASK	310
#define	AUE_DARWIN_MPROTECT	311
#define	AUE_DARWIN_SETPRIORITY	312
#define	AUE_DARWIN_SETTIMEOFDAY	313
#define	AUE_DARWIN_FLOCK	314
#define	AUE_DARWIN_MKFIFO	315
#define	AUE_DARWIN_POLL		316
#define	AUE_DARWIN_SOCKETPAIR	317
#define	AUE_DARWIN_FUTIMES	318
#define	AUE_DARWIN_SETSID	319
#define	AUE_DARWIN_SETPRIVEXEC	320	/* Darwin-specific. */
#define	AUE_DARWIN_NFSSVC	321
#define	AUE_DARWIN_GETFH	322
#define	AUE_DARWIN_QUOTACTL	323
#define	AUE_DARWIN_ADDPROFILE	324	/* Darwin-specific. */
#define	AUE_DARWIN_KDEBUGTRACE	325	/* Darwin-specific. */
#define	AUE_DARWIN_KDBUGTRACE	AUE_KDEBUGTRACE
#define	AUE_DARWIN_FSTAT	326
#define	AUE_DARWIN_FPATHCONF	327
#define	AUE_DARWIN_GETDIRENTRIES	328
#define	AUE_DARWIN_TRUNCATE	329
#define	AUE_DARWIN_FTRUNCATE	330
#define	AUE_DARWIN_SYSCTL	331
#define	AUE_DARWIN_MLOCK	332
#define	AUE_DARWIN_MUNLOCK	333
#define	AUE_DARWIN_UNDELETE	334
#define	AUE_DARWIN_GETATTRLIST	335	/* Darwin-specific. */
#define	AUE_DARWIN_SETATTRLIST	336	/* Darwin-specific. */
#define	AUE_DARWIN_GETDIRENTRIESATTR	337	/* Darwin-specific. */
#define	AUE_DARWIN_EXCHANGEDATA	338	/* Darwin-specific. */
#define	AUE_DARWIN_SEARCHFS	339	/* Darwin-specific. */
#define	AUE_DARWIN_MINHERIT	340
#define	AUE_DARWIN_SEMCONFIG	341
#define	AUE_DARWIN_SEMOPEN	342
#define	AUE_DARWIN_SEMCLOSE	343
#define	AUE_DARWIN_SEMUNLINK	344
#define	AUE_DARWIN_SHMOPEN	345
#define	AUE_DARWIN_SHMUNLINK	346
#define	AUE_DARWIN_LOADSHFILE	347	/* Darwin-specific. */
#define	AUE_DARWIN_RESETSHFILE	348	/* Darwin-specific. */
#define	AUE_DARWIN_NEWSYSTEMSHREG	349	/* Darwin-specific. */
#define	AUE_DARWIN_PTHREADKILL	350	/* Darwin-specific. */
#define	AUE_DARWIN_PTHREADSIGMASK	351	/* Darwin-specific. */
#define	AUE_DARWIN_AUDITCTL	352
#define	AUE_DARWIN_RFORK	353
#define	AUE_DARWIN_LCHMOD	354
#define	AUE_DARWIN_SWAPOFF	355
#define	AUE_DARWIN_INITPROCESS	356	/* Darwin-specific. */
#define	AUE_DARWIN_MAPFD	357	/* Darwin-specific. */
#define	AUE_DARWIN_TASKFORPID	358	/* Darwin-specific. */
#define	AUE_DARWIN_PIDFORTASK	359	/* Darwin-specific. */
#define	AUE_DARWIN_SYSCTL_NONADMIN	360
#define	AUE_DARWIN_COPYFILE	361	/* Darwin-specific. */

/*
 * Audit event identifiers added as part of OpenBSM, generally corresponding
 * to events in FreeBSD, Darwin, and Linux that were not present in Solaris.
 * These often duplicate events added to the Solaris set by Darwin, but use
 * event identifiers in a higher range in order to avoid colliding with
 * future Solaris additions.
 *
 * If an event in this section is later added to Solaris, we prefer the
 * Solaris event identifier, and add _OPENBSM_ to the OpenBSM-specific
 * identifier so that old trails can still be processed, but new trails use
 * the Solaris identifier.
 */
#define	AUE_GETFSSTAT		43001
#define	AUE_PTRACE		43002
#define	AUE_CHFLAGS		43003
#define	AUE_FCHFLAGS		43004
#define	AUE_PROFILE		43005
#define	AUE_KTRACE		43006
#define	AUE_SETLOGIN		43007
#define	AUE_OPENBSM_REVOKE	43008	/* Solaris event now preferred. */
#define	AUE_UMASK		43009
#define	AUE_MPROTECT		43010
#define	AUE_MKFIFO		43011
#define	AUE_POLL		43012
#define	AUE_FUTIMES		43013
#define	AUE_SETSID		43014
#define	AUE_SETPRIVEXEC		43015	/* Darwin-specific. */
#define	AUE_ADDPROFILE		43016	/* Darwin-specific. */
#define	AUE_KDEBUGTRACE		43017	/* Darwin-specific. */
#define	AUE_KDBUGTRACE		AUE_KDEBUGTRACE
#define	AUE_OPENBSM_FSTAT	43018	/* Solaris event now preferred. */
#define	AUE_FPATHCONF		43019
#define	AUE_GETDIRENTRIES	43020
#define	AUE_SYSCTL		43021
#define	AUE_MLOCK		43022
#define	AUE_MUNLOCK		43023
#define	AUE_UNDELETE		43024
#define	AUE_GETATTRLIST		43025	/* Darwin-specific. */
#define	AUE_SETATTRLIST		43026	/* Darwin-specific. */
#define	AUE_GETDIRENTRIESATTR	43027	/* Darwin-specific. */
#define	AUE_EXCHANGEDATA	43028	/* Darwin-specific. */
#define	AUE_SEARCHFS		43029	/* Darwin-specific. */
#define	AUE_MINHERIT		43030
#define	AUE_SEMCONFIG		43031
#define	AUE_SEMOPEN		43032
#define	AUE_SEMCLOSE		43033
#define	AUE_SEMUNLINK		43034
#define	AUE_SHMOPEN		43035
#define	AUE_SHMUNLINK		43036
#define	AUE_LOADSHFILE		43037	/* Darwin-specific. */
#define	AUE_RESETSHFILE		43038	/* Darwin-specific. */
#define	AUE_NEWSYSTEMSHREG	43039	/* Darwin-specific. */
#define	AUE_PTHREADKILL		43040	/* Darwin-specific. */
#define	AUE_PTHREADSIGMASK	43041	/* Darwin-specific. */
#define	AUE_AUDITCTL		43042
#define	AUE_RFORK		43043
#define	AUE_LCHMOD		43044
#define	AUE_SWAPOFF		43045
#define	AUE_INITPROCESS		43046	/* Darwin-specific. */
#define	AUE_MAPFD		43047	/* Darwin-specific. */
#define	AUE_TASKFORPID		43048	/* Darwin-specific. */
#define	AUE_PIDFORTASK		43049	/* Darwin-specific. */
#define	AUE_SYSCTL_NONADMIN	43050
#define	AUE_COPYFILE		43051	/* Darwin-specific. */

/*
 * Events added to OpenBSM for FreeBSD and Linux; may also be used by Darwin
 * in the future.
 */
#define	AUE_LUTIMES		43052
#define	AUE_LCHFLAGS		43053	/* FreeBSD-specific. */
#define	AUE_SENDFILE		43054	/* BSD/Linux-specific. */
#define	AUE_USELIB		43055	/* Linux-specific. */
#define	AUE_GETRESUID		43056
#define	AUE_SETRESUID		43057
#define	AUE_GETRESGID		43058
#define	AUE_SETRESGID		43059
#define	AUE_WAIT4		43060	/* FreeBSD-specific. */
#define	AUE_LGETFH		43061	/* FreeBSD-specific. */
#define	AUE_FHSTATFS		43062	/* FreeBSD-specific. */
#define	AUE_FHOPEN		43063	/* FreeBSD-specific. */
#define	AUE_FHSTAT		43064	/* FreeBSD-specific. */
#define	AUE_JAIL		43065	/* FreeBSD-specific. */
#define	AUE_EACCESS		43066	/* FreeBSD-specific. */
#define	AUE_KQUEUE		43067	/* FreeBSD-specific. */
#define	AUE_KEVENT		43068	/* FreeBSD-specific. */
#define	AUE_FSYNC		43069
#define	AUE_NMOUNT		43070	/* FreeBSD-specific. */
#define	AUE_BDFLUSH		43071	/* Linux-specific. */
#define	AUE_SETFSUID		43072	/* Linux-specific. */
#define	AUE_SETFSGID		43073	/* Linux-specific. */
#define	AUE_PERSONALITY		43074	/* Linux-specific. */
#define	AUE_SCHED_GETSCHEDULER	43075	/* POSIX.1b. */
#define	AUE_SCHED_SETSCHEDULER	43076	/* POSIX.1b. */
#define	AUE_PRCTL		43077	/* Linux-specific. */
#define	AUE_GETCWD		43078	/* FreeBSD/Linux-specific. */
#define	AUE_CAPGET		43079	/* Linux-specific. */
#define	AUE_CAPSET		43080	/* Linux-specific. */
#define	AUE_PIVOT_ROOT		43081	/* Linux-specific. */
#define	AUE_RTPRIO		43082	/* FreeBSD-specific. */
#define	AUE_SCHED_GETPARAM	43083	/* POSIX.1b. */
#define	AUE_SCHED_SETPARAM	43084	/* POSIX.1b. */
#define	AUE_SCHED_GET_PRIORITY_MAX	43085	/* POSIX.1b. */
#define	AUE_SCHED_GET_PRIORITY_MIN	43086	/* POSIX.1b. */
#define	AUE_SCHED_RR_GET_INTERVAL	43087	/* POSIX.1b. */
#define	AUE_ACL_GET_FILE	43088	/* FreeBSD. */
#define	AUE_ACL_SET_FILE	43089	/* FreeBSD. */
#define	AUE_ACL_GET_FD		43090	/* FreeBSD. */
#define	AUE_ACL_SET_FD		43091	/* FreeBSD. */
#define	AUE_ACL_DELETE_FILE	43092	/* FreeBSD. */
#define	AUE_ACL_DELETE_FD	43093	/* FreeBSD. */
#define	AUE_ACL_CHECK_FILE	43094	/* FreeBSD. */
#define	AUE_ACL_CHECK_FD	43095	/* FreeBSD. */
#define	AUE_ACL_GET_LINK	43096	/* FreeBSD. */
#define	AUE_ACL_SET_LINK	43097	/* FreeBSD. */
#define	AUE_ACL_DELETE_LINK	43098	/* FreeBSD. */
#define	AUE_ACL_CHECK_LINK	43099	/* FreeBSD. */
#define	AUE_SYSARCH		43100	/* FreeBSD. */
#define	AUE_EXTATTRCTL		43101	/* FreeBSD. */
#define	AUE_EXTATTR_GET_FILE	43102	/* FreeBSD. */
#define	AUE_EXTATTR_SET_FILE	43103	/* FreeBSD. */
#define	AUE_EXTATTR_LIST_FILE	43104	/* FreeBSD. */
#define	AUE_EXTATTR_DELETE_FILE	43105	/* FreeBSD. */
#define	AUE_EXTATTR_GET_FD	43106	/* FreeBSD. */
#define	AUE_EXTATTR_SET_FD	43107	/* FreeBSD. */
#define	AUE_EXTATTR_LIST_FD	43108	/* FreeBSD. */
#define	AUE_EXTATTR_DELETE_FD	43109	/* FreeBSD. */
#define	AUE_EXTATTR_GET_LINK	43110	/* FreeBSD. */
#define	AUE_EXTATTR_SET_LINK	43111	/* FreeBSD. */
#define	AUE_EXTATTR_LIST_LINK	43112	/* FreeBSD. */
#define	AUE_EXTATTR_DELETE_LINK	43113	/* FreeBSD. */
#define	AUE_KENV		43114	/* FreeBSD. */
#define	AUE_JAIL_ATTACH		43115	/* FreeBSD. */
#define	AUE_SYSCTL_WRITE	43116	/* FreeBSD. */
#define	AUE_IOPERM		43117	/* Linux. */
#define	AUE_READDIR		43118	/* Linux. */
#define	AUE_IOPL		43119	/* Linux. */
#define	AUE_VM86		43120	/* Linux. */
#define	AUE_MAC_GET_PROC	43121	/* FreeBSD/Darwin. */
#define	AUE_MAC_SET_PROC	43122	/* FreeBSD/Darwin. */
#define	AUE_MAC_GET_FD		43123	/* FreeBSD/Darwin. */
#define	AUE_MAC_GET_FILE	43124	/* FreeBSD/Darwin. */
#define	AUE_MAC_SET_FD		43125	/* FreeBSD/Darwin. */
#define	AUE_MAC_SET_FILE	43126	/* FreeBSD/Darwin. */
#define	AUE_MAC_SYSCALL		43127	/* FreeBSD. */
#define	AUE_MAC_GET_PID		43128	/* FreeBSD/Darwin. */
#define	AUE_MAC_GET_LINK	43129	/* FreeBSD/Darwin. */
#define	AUE_MAC_SET_LINK	43130	/* FreeBSD/Darwin. */
#define	AUE_MAC_EXECVE		43131	/* FreeBSD/Darwin. */
#define	AUE_GETPATH_FROMFD	43132	/* FreeBSD. */
#define	AUE_GETPATH_FROMADDR	43133	/* FreeBSD. */
#define	AUE_MQ_OPEN		43134	/* FreeBSD. */
#define	AUE_MQ_SETATTR		43135	/* FreeBSD. */
#define	AUE_MQ_TIMEDRECEIVE	43136	/* FreeBSD. */
#define	AUE_MQ_TIMEDSEND	43137	/* FreeBSD. */
#define	AUE_MQ_NOTIFY		43138	/* FreeBSD. */
#define	AUE_MQ_UNLINK		43139	/* FreeBSD. */
#define	AUE_LISTEN		43140	/* FreeBSD/Darwin/Linux. */
#define	AUE_MLOCKALL		43141	/* FreeBSD. */
#define	AUE_MUNLOCKALL		43142	/* FreeBSD. */
#define	AUE_CLOSEFROM		43143	/* FreeBSD. */
#define	AUE_FEXECVE		43144	/* FreeBSD. */
#define	AUE_FACCESSAT		43145	/* FreeBSD. */
#define	AUE_FCHMODAT		43146	/* FreeBSD. */
#define	AUE_LINKAT		43147	/* FreeBSD. */
#define	AUE_MKDIRAT		43148	/* FreeBSD. */
#define	AUE_MKFIFOAT		43149	/* FreeBSD. */
#define	AUE_MKNODAT		43150	/* FreeBSD. */
#define	AUE_READLINKAT		43151	/* FreeBSD. */
#define	AUE_SYMLINKAT		43152	/* FreeBSD. */
#define	AUE_MAC_GETFSSTAT	43153	/* Darwin. */
#define	AUE_MAC_GET_MOUNT	43154	/* Darwin. */
#define	AUE_MAC_GET_LCID	43155	/* Darwin. */
#define	AUE_MAC_GET_LCTX	43156	/* Darwin. */
#define	AUE_MAC_SET_LCTX	43157	/* Darwin. */
#define	AUE_MAC_MOUNT		43158	/* Darwin. */
#define	AUE_GETLCID		43159	/* Darwin. */
#define	AUE_SETLCID		43160	/* Darwin. */
#define	AUE_TASKNAMEFORPID	43161	/* Darwin. */
#define	AUE_ACCESS_EXTENDED	43162	/* Darwin. */
#define	AUE_CHMOD_EXTENDED	43163	/* Darwin. */
#define	AUE_FCHMOD_EXTENDED	43164	/* Darwin. */
#define	AUE_FSTAT_EXTENDED	43165	/* Darwin. */
#define	AUE_LSTAT_EXTENDED	43166	/* Darwin. */
#define	AUE_MKDIR_EXTENDED	43167	/* Darwin. */
#define	AUE_MKFIFO_EXTENDED	43168	/* Darwin. */
#define	AUE_OPEN_EXTENDED	43169	/* Darwin. */
#define	AUE_OPEN_EXTENDED_R	43170	/* Darwin. */
#define	AUE_OPEN_EXTENDED_RC	43171	/* Darwin. */
#define	AUE_OPEN_EXTENDED_RT	43172	/* Darwin. */
#define	AUE_OPEN_EXTENDED_RTC	43173	/* Darwin. */
#define	AUE_OPEN_EXTENDED_W	43174	/* Darwin. */
#define	AUE_OPEN_EXTENDED_WC	43175	/* Darwin. */
#define	AUE_OPEN_EXTENDED_WT	43176	/* Darwin. */
#define	AUE_OPEN_EXTENDED_WTC	43177	/* Darwin. */
#define	AUE_OPEN_EXTENDED_RW	43178	/* Darwin. */
#define	AUE_OPEN_EXTENDED_RWC	43179	/* Darwin. */
#define	AUE_OPEN_EXTENDED_RWT	43180	/* Darwin. */
#define	AUE_OPEN_EXTENDED_RWTC	43181	/* Darwin. */
#define	AUE_STAT_EXTENDED	43182	/* Darwin. */
#define	AUE_UMASK_EXTENDED	43183	/* Darwin. */
#define	AUE_OPENAT		43184	/* FreeBSD. */
#define	AUE_POSIX_OPENPT	43185	/* FreeBSD. */
#define	AUE_CAP_NEW		43186	/* TrustedBSD. */
#define	AUE_CAP_GETRIGHTS	43187	/* TrustedBSD. */
#define	AUE_CAP_ENTER		43188	/* TrustedBSD. */
#define	AUE_CAP_GETMODE		43189	/* TrustedBSD. */
#define	AUE_POSIX_SPAWN		43190	/* Darwin. */
#define	AUE_FSGETPATH		43191	/* Darwin. */
#define	AUE_PREAD		43192	/* Darwin/FreeBSD. */
#define	AUE_PWRITE		43193	/* Darwin/FreeBSD. */
#define	AUE_FSCTL		43194	/* Darwin. */
#define	AUE_FFSCTL		43195	/* Darwin. */
#define	AUE_LPATHCONF		43196	/* FreeBSD. */
#define	AUE_PDFORK		43197	/* FreeBSD. */
#define	AUE_PDKILL		43198	/* FreeBSD. */
#define	AUE_PDGETPID		43199	/* FreeBSD. */
#define	AUE_PDWAIT		43200	/* FreeBSD. */

/*
 * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the
 * normal Solaris BSM identifiers.  _O_ refers to it being an old, or compat
 * interface.  In most cases, Darwin has never implemented these system calls
 * but picked up the fields in their system call table from their FreeBSD
 * import.  Happily, these have different names than the AUE_O* definitions
 * in Solaris BSM.
 */
#define	AUE_O_CREAT		AUE_OPEN_RWTC	/* Darwin */
#define	AUE_O_EXECVE		AUE_NULL	/* Darwin */
#define	AUE_O_SBREAK		AUE_NULL	/* Darwin */
#define	AUE_O_LSEEK		AUE_NULL	/* Darwin */
#define	AUE_O_MOUNT		AUE_NULL	/* Darwin */
#define	AUE_O_UMOUNT		AUE_NULL	/* Darwin */
#define	AUE_O_STAT		AUE_STAT	/* Darwin */
#define	AUE_O_LSTAT		AUE_LSTAT	/* Darwin */
#define	AUE_O_FSTAT		AUE_FSTAT	/* Darwin */
#define	AUE_O_GETPAGESIZE	AUE_NULL	/* Darwin */
#define	AUE_O_VREAD		AUE_NULL	/* Darwin */
#define	AUE_O_VWRITE		AUE_NULL	/* Darwin */
#define	AUE_O_MMAP		AUE_MMAP	/* Darwin */
#define	AUE_O_VADVISE		AUE_NULL	/* Darwin */
#define	AUE_O_VHANGUP		AUE_NULL	/* Darwin */
#define	AUE_O_VLIMIT		AUE_NULL	/* Darwin */
#define	AUE_O_WAIT		AUE_NULL	/* Darwin */
#define	AUE_O_GETHOSTNAME	AUE_NULL	/* Darwin */
#define	AUE_O_SETHOSTNAME	AUE_SYSCTL	/* Darwin */
#define	AUE_O_GETDOPT		AUE_NULL	/* Darwin */
#define	AUE_O_SETDOPT		AUE_NULL	/* Darwin */
#define	AUE_O_ACCEPT		AUE_NULL	/* Darwin */
#define	AUE_O_SEND		AUE_SENDMSG	/* Darwin */
#define	AUE_O_RECV		AUE_RECVMSG	/* Darwin */
#define	AUE_O_VTIMES		AUE_NULL	/* Darwin */
#define	AUE_O_SIGVEC		AUE_NULL	/* Darwin */
#define	AUE_O_SIGBLOCK		AUE_NULL	/* Darwin */
#define	AUE_O_SIGSETMASK	AUE_NULL	/* Darwin */
#define	AUE_O_SIGSTACK		AUE_NULL	/* Darwin */
#define	AUE_O_RECVMSG		AUE_RECVMSG	/* Darwin */
#define	AUE_O_SENDMSG		AUE_SENDMSG	/* Darwin */
#define	AUE_O_VTRACE		AUE_NULL	/* Darwin */
#define	AUE_O_RESUBA		AUE_NULL	/* Darwin */
#define	AUE_O_RECVFROM		AUE_RECVFROM	/* Darwin */
#define	AUE_O_SETREUID		AUE_SETREUID	/* Darwin */
#define	AUE_O_SETREGID		AUE_SETREGID	/* Darwin */
#define	AUE_O_GETDIRENTRIES	AUE_GETDIRENTRIES	/* Darwin */
#define	AUE_O_TRUNCATE		AUE_TRUNCATE	/* Darwin */
#define	AUE_O_FTRUNCATE		AUE_FTRUNCATE	/* Darwin */
#define	AUE_O_GETPEERNAME	AUE_NULL	/* Darwin */
#define	AUE_O_GETHOSTID		AUE_NULL	/* Darwin */
#define	AUE_O_SETHOSTID		AUE_NULL	/* Darwin */
#define	AUE_O_GETRLIMIT		AUE_NULL	/* Darwin */
#define	AUE_O_SETRLIMIT		AUE_SETRLIMIT	/* Darwin */
#define	AUE_O_KILLPG		AUE_KILL	/* Darwin */
#define	AUE_O_SETQUOTA		AUE_NULL	/* Darwin */
#define	AUE_O_QUOTA		AUE_NULL	/* Darwin */
#define	AUE_O_GETSOCKNAME	AUE_NULL	/* Darwin */
#define	AUE_O_GETDIREENTRIES	AUE_GETDIREENTRIES	/* Darwin */
#define	AUE_O_ASYNCDAEMON	AUE_NULL	/* Darwin */
#define	AUE_O_GETDOMAINNAME	AUE_NULL	/* Darwin */
#define	AUE_O_SETDOMAINNAME	AUE_SYSCTL	/* Darwin */
#define	AUE_O_PCFS_MOUNT	AUE_NULL	/* Darwin */
#define	AUE_O_EXPORTFS		AUE_NULL	/* Darwin */
#define	AUE_O_USTATE		AUE_NULL	/* Darwin */
#define	AUE_O_WAIT3		AUE_NULL	/* Darwin */
#define	AUE_O_RPAUSE		AUE_NULL	/* Darwin */
#define	AUE_O_GETDENTS		AUE_NULL	/* Darwin */

/*
 * Possible desired future values based on review of BSD/Darwin system calls.
 */
#define	AUE_ATGETMSG		AUE_NULL
#define	AUE_ATPUTMSG		AUE_NULL
#define	AUE_ATSOCKET		AUE_NULL
#define	AUE_ATPGETREQ		AUE_NULL
#define	AUE_ATPGETRSP		AUE_NULL
#define	AUE_ATPSNDREQ		AUE_NULL
#define	AUE_ATPSNDRSP		AUE_NULL
#define	AUE_BSDTHREADCREATE	AUE_NULL
#define	AUE_BSDTHREADTERMINATE	AUE_NULL
#define	AUE_BSDTHREADREGISTER	AUE_NULL
#define	AUE_CHUD		AUE_NULL
#define	AUE_CSOPS		AUE_NULL
#define	AUE_DUP			AUE_NULL
#define	AUE_FDATASYNC		AUE_NULL
#define	AUE_FGETATTRLIST	AUE_NULL
#define	AUE_FGETXATTR		AUE_NULL
#define	AUE_FLISTXATTR		AUE_NULL
#define	AUE_FREMOVEXATTR	AUE_NULL
#define	AUE_FSETATTRLIST	AUE_NULL
#define	AUE_FSETXATTR		AUE_NULL
#define	AUE_FSTATFS64		AUE_NULL
#define	AUE_FSTATV		AUE_NULL
#define	AUE_FSTAT64		AUE_NULL
#define	AUE_FSTAT64_EXTENDED	AUE_NULL
#define	AUE_GCCONTROL		AUE_NULL
#define	AUE_GETDIRENTRIES64	AUE_NULL
#define	AUE_GETDTABLESIZE	AUE_NULL
#define	AUE_GETEGID		AUE_NULL
#define	AUE_GETEUID		AUE_NULL
#define	AUE_GETFSSTAT64		AUE_NULL
#define	AUE_GETGID		AUE_NULL
#define	AUE_GETGROUPS		AUE_NULL
#define	AUE_GETITIMER		AUE_NULL
#define	AUE_GETLOGIN		AUE_NULL
#define	AUE_GETPEERNAME		AUE_NULL
#define	AUE_GETPGID		AUE_NULL
#define	AUE_GETPGRP		AUE_NULL
#define	AUE_GETPID		AUE_NULL
#define	AUE_GETPPID		AUE_NULL
#define	AUE_GETPRIORITY		AUE_NULL
#define	AUE_GETRLIMIT		AUE_NULL
#define	AUE_GETRUSAGE		AUE_NULL
#define	AUE_GETSGROUPS		AUE_NULL
#define	AUE_GETSID		AUE_NULL
#define	AUE_GETSOCKNAME		AUE_NULL
#define	AUE_GETTIMEOFDAY	AUE_NULL
#define	AUE_GETTID		AUE_NULL
#define	AUE_GETUID		AUE_NULL
#define	AUE_GETSOCKOPT		AUE_NULL
#define	AUE_GETWGROUPS		AUE_NULL
#define	AUE_GETXATTR		AUE_NULL
#define	AUE_IDENTITYSVC		AUE_NULL
#define	AUE_INITGROUPS		AUE_NULL
#define	AUE_IOPOLICYSYS		AUE_NULL
#define	AUE_ISSETUGID		AUE_NULL
#define	AUE_LIOLISTIO		AUE_NULL
#define	AUE_LISTXATTR		AUE_NULL
#define	AUE_LSTATV		AUE_NULL
#define	AUE_LSTAT64		AUE_NULL
#define	AUE_LSTAT64_EXTENDED	AUE_NULL
#define	AUE_MADVISE		AUE_NULL
#define	AUE_MINCORE		AUE_NULL
#define	AUE_MKCOMPLEX		AUE_NULL
#define	AUE_MODWATCH		AUE_NULL
#define	AUE_MSGCL		AUE_NULL
#define	AUE_MSYNC		AUE_NULL
#define	AUE_PREADV		AUE_NULL
#define	AUE_PROCINFO		AUE_NULL
#define	AUE_PTHREADCANCELED	AUE_NULL
#define	AUE_PTHREADCHDIR	AUE_NULL
#define	AUE_PTHREADCONDBROADCAST	AUE_NULL
#define	AUE_PTHREADCONDDESTORY	AUE_NULL
#define	AUE_PTHREADCONDINIT	AUE_NULL
#define	AUE_PTHREADCONDSIGNAL	AUE_NULL
#define	AUE_PTHREADCONDWAIT	AUE_NULL
#define	AUE_PTHREADFCHDIR	AUE_NULL
#define	AUE_PTHREADMARK		AUE_NULL
#define	AUE_PTHREADMUTEXDESTROY	AUE_NULL
#define	AUE_PTHREADMUTEXINIT	AUE_NULL
#define	AUE_PTHREADMUTEXTRYLOCK	AUE_NULL
#define	AUE_PTHREADMUTEXUNLOCK	AUE_NULL
#define	AUE_PWRITEV		AUE_NULL
#define	AUE_REMOVEXATTR		AUE_NULL
#define	AUE_SBRK		AUE_NULL
#define	AUE_SELECT		AUE_NULL
#define	AUE_SEMDESTROY		AUE_NULL
#define	AUE_SEMGETVALUE		AUE_NULL
#define	AUE_SEMINIT		AUE_NULL
#define	AUE_SEMPOST		AUE_NULL
#define	AUE_SEMTRYWAIT		AUE_NULL
#define	AUE_SEMWAIT		AUE_NULL
#define	AUE_SEMWAITSIGNAL	AUE_NULL
#define	AUE_SETITIMER		AUE_NULL
#define	AUE_SETSGROUPS		AUE_NULL
#define	AUE_SETTID		AUE_NULL
#define	AUE_SETTIDWITHPID	AUE_NULL
#define	AUE_SETWGROUPS		AUE_NULL
#define	AUE_SETXATTR		AUE_NULL
#define	AUE_SHAREDREGIONCHECK	AUE_NULL
#define	AUE_SHAREDREGIONMAP	AUE_NULL
#define	AUE_SIGACTION		AUE_NULL
#define	AUE_SIGALTSTACK		AUE_NULL
#define	AUE_SIGPENDING		AUE_NULL
#define	AUE_SIGPROCMASK		AUE_NULL
#define	AUE_SIGRETURN		AUE_NULL
#define	AUE_SIGSUSPEND		AUE_NULL
#define	AUE_SIGWAIT		AUE_NULL
#define	AUE_SSTK		AUE_NULL
#define	AUE_STACKSNAPSHOT	AUE_NULL
#define	AUE_STATFS64		AUE_NULL
#define	AUE_STATV		AUE_NULL
#define	AUE_STAT64		AUE_NULL
#define	AUE_STAT64_EXTENDED	AUE_NULL
#define	AUE_SYNC		AUE_NULL
#define	AUE_SYSCALL		AUE_NULL
#define	AUE_TABLE		AUE_NULL
#define	AUE_VMPRESSUREMONITOR	AUE_NULL
#define	AUE_WAITEVENT		AUE_NULL
#define	AUE_WAITID		AUE_NULL
#define	AUE_WATCHEVENT		AUE_NULL
#define	AUE_WORKQOPEN		AUE_NULL
#define	AUE_WORKQOPS		AUE_NULL

#endif /* !_BSM_AUDIT_KEVENTS_H_ */


code:
/*-
 * Copyright (c) 2005-2009 Apple Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in the
 *     documentation and/or other materials provided with the distribution.
 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 *     its contributors may be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_record.h#10
 * $FreeBSD: release/9.0.0/sys/bsm/audit_record.h 191270 2009-04-19 14:53:17Z rwatson $
 */

#ifndef _BSM_AUDIT_RECORD_H_
#define _BSM_AUDIT_RECORD_H_

#include <sys/time.h>			/* struct timeval */

/*
 * Token type identifiers.
 */
#define	AUT_INVALID		0x00
#define	AUT_OTHER_FILE32	0x11
#define	AUT_OHEADER		0x12
#define	AUT_TRAILER		0x13
#define	AUT_HEADER32		0x14
#define	AUT_HEADER32_EX		0x15
#define	AUT_DATA		0x21
#define	AUT_IPC			0x22
#define	AUT_PATH		0x23
#define	AUT_SUBJECT32		0x24
#define	AUT_XATPATH		0x25
#define	AUT_PROCESS32		0x26
#define	AUT_RETURN32		0x27
#define	AUT_TEXT		0x28
#define	AUT_OPAQUE		0x29
#define	AUT_IN_ADDR		0x2a
#define	AUT_IP			0x2b
#define	AUT_IPORT		0x2c
#define	AUT_ARG32		0x2d
#define	AUT_SOCKET		0x2e
#define	AUT_SEQ			0x2f
#define	AUT_ACL			0x30
#define	AUT_ATTR		0x31
#define	AUT_IPC_PERM		0x32
#define	AUT_LABEL		0x33
#define	AUT_GROUPS		0x34
#define	AUT_ACE			0x35
#define	AUT_PRIV		0x38
#define	AUT_UPRIV		0x39
#define	AUT_LIAISON		0x3a
#define	AUT_NEWGROUPS		0x3b
#define	AUT_EXEC_ARGS		0x3c
#define	AUT_EXEC_ENV		0x3d
#define	AUT_ATTR32		0x3e
#define	AUT_UNAUTH		0x3f
#define	AUT_XATOM		0x40
#define	AUT_XOBJ		0x41
#define	AUT_XPROTO		0x42
#define	AUT_XSELECT		0x43
#define	AUT_XCOLORMAP		0x44
#define	AUT_XCURSOR		0x45
#define	AUT_XFONT		0x46
#define	AUT_XGC			0x47
#define	AUT_XPIXMAP		0x48
#define	AUT_XPROPERTY		0x49
#define	AUT_XWINDOW		0x4a
#define	AUT_XCLIENT		0x4b
#define	AUT_CMD			0x51
#define	AUT_EXIT		0x52
#define	AUT_ZONENAME		0x60
#define	AUT_HOST		0x70
#define	AUT_ARG64		0x71
#define	AUT_RETURN64		0x72
#define	AUT_ATTR64		0x73
#define	AUT_HEADER64		0x74
#define	AUT_SUBJECT64		0x75
#define	AUT_PROCESS64		0x77
#define	AUT_OTHER_FILE64	0x78
#define	AUT_HEADER64_EX		0x79
#define	AUT_SUBJECT32_EX	0x7a
#define	AUT_PROCESS32_EX	0x7b
#define	AUT_SUBJECT64_EX	0x7c
#define	AUT_PROCESS64_EX	0x7d
#define	AUT_IN_ADDR_EX		0x7e
#define	AUT_SOCKET_EX		0x7f

/*
 * Pre-64-bit BSM, 32-bit tokens weren't explicitly named as '32'.  We have
 * compatibility defines.
 */
#define	AUT_HEADER		AUT_HEADER32
#define	AUT_ARG			AUT_ARG32
#define	AUT_RETURN		AUT_RETURN32
#define	AUT_SUBJECT		AUT_SUBJECT32
#define	AUT_PROCESS		AUT_PROCESS32
#define	AUT_OTHER_FILE		AUT_OTHER_FILE32

/*
 * The values for the following token ids are not defined by BSM.
 *
 * XXXRW: Not sure how to handle these in OpenBSM yet, but I'll give them
 * names more consistent with Sun's BSM.  These originally came from Apple's
 * BSM.
 */
#define	AUT_SOCKINET32		0x80		/* XXX */
#define	AUT_SOCKINET128		0x81		/* XXX */
#define	AUT_SOCKUNIX		0x82		/* XXX */

/* print values for the arbitrary token */
#define AUP_BINARY      0
#define AUP_OCTAL       1
#define AUP_DECIMAL     2
#define AUP_HEX         3
#define AUP_STRING      4

/* data-types for the arbitrary token */
#define AUR_BYTE        0
#define AUR_CHAR        AUR_BYTE
#define AUR_SHORT       1
#define AUR_INT32       2
#define AUR_INT         AUR_INT32
#define AUR_INT64       3

/* ... and their sizes */
#define AUR_BYTE_SIZE       sizeof(u_char)
#define AUR_CHAR_SIZE       AUR_BYTE_SIZE
#define AUR_SHORT_SIZE      sizeof(uint16_t)
#define AUR_INT32_SIZE      sizeof(uint32_t)
#define AUR_INT_SIZE        AUR_INT32_SIZE
#define AUR_INT64_SIZE      sizeof(uint64_t)

/* Modifiers for the header token */
#define PAD_NOTATTR  0x4000   /* nonattributable event */
#define PAD_FAILURE  0x8000   /* fail audit event */

#define AUDIT_MAX_GROUPS      16

/*
 * A number of BSM versions are floating around and defined.  Here are
 * constants for them.  OpenBSM uses the same token types, etc, used in the
 * Solaris BSM version, but has a separate version number in order to
 * identify a potentially different event identifier name space.
 */
#define	AUDIT_HEADER_VERSION_OLDDARWIN	1	/* In retrospect, a mistake. */
#define	AUDIT_HEADER_VERSION_SOLARIS	2
#define	AUDIT_HEADER_VERSION_TSOL25	3
#define	AUDIT_HEADER_VERSION_TSOL	4
#define	AUDIT_HEADER_VERSION_OPENBSM10	10
#define	AUDIT_HEADER_VERSION_OPENBSM11	11
#define	AUDIT_HEADER_VERSION_OPENBSM	AUDIT_HEADER_VERSION_OPENBSM11

#define	AUT_TRAILER_MAGIC	0xb105

/* BSM library calls */

__BEGIN_DECLS

struct in_addr;
struct in6_addr;
struct ip;
struct ipc_perm;
struct kevent;
struct sockaddr;
struct sockaddr_in;
struct sockaddr_in6;
struct sockaddr_un;
#if defined(_KERNEL) || defined(KERNEL)
struct vnode_au_info;
#endif

int	 au_open(void);
int	 au_write(int d, token_t *m);
int	 au_close(int d, int keep, short event);
int	 au_close_buffer(int d, short event, u_char *buffer, size_t *buflen);
int	 au_close_token(token_t *tok, u_char *buffer, size_t *buflen);

token_t	*au_to_file(const char *file, struct timeval tm);

token_t	*au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
	    struct timeval tm);
token_t	*au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
	    struct timeval tm, struct auditinfo_addr *aia);
token_t	*au_to_header64_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
	    struct timeval tm);
#if !defined(KERNEL) && !defined(_KERNEL)
token_t	*au_to_header(int rec_size, au_event_t e_type, au_emod_t e_mod);
token_t	*au_to_header_ex(int rec_size, au_event_t e_type, au_emod_t e_mod);
token_t	*au_to_header32(int rec_size, au_event_t e_type, au_emod_t e_mod);
token_t	*au_to_header64(int rec_size, au_event_t e_type, au_emod_t e_mod);
token_t	*au_to_header32_ex(int rec_size, au_event_t e_type, au_emod_t e_mod);
#endif

token_t	*au_to_me(void);
token_t	*au_to_arg(char n, const char *text, uint32_t v);
token_t	*au_to_arg32(char n, const char *text, uint32_t v);
token_t	*au_to_arg64(char n, const char *text, uint64_t v);

#if defined(_KERNEL) || defined(KERNEL)
token_t	*au_to_attr(struct vnode_au_info *vni);
token_t	*au_to_attr32(struct vnode_au_info *vni);
token_t	*au_to_attr64(struct vnode_au_info *vni);
#endif

token_t	*au_to_data(char unit_print, char unit_type, char unit_count,
	    const char *p);
token_t	*au_to_exit(int retval, int err);
token_t	*au_to_groups(int *groups);
token_t	*au_to_newgroups(uint16_t n, gid_t *groups);
token_t	*au_to_in_addr(struct in_addr *internet_addr);
token_t	*au_to_in_addr_ex(struct in6_addr *internet_addr);
token_t	*au_to_ip(struct ip *ip);
token_t	*au_to_ipc(char type, int id);
token_t	*au_to_ipc_perm(struct ipc_perm *perm);
token_t	*au_to_iport(uint16_t iport);
token_t	*au_to_opaque(const char *data, uint16_t bytes);
token_t	*au_to_path(const char *path);
token_t	*au_to_process(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
token_t	*au_to_process32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
token_t	*au_to_process64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
token_t	*au_to_process_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
token_t	*au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid,
	    uid_t ruid, gid_t rgid, pid_t pid, au_asid_t sid,
	    au_tid_addr_t *tid);
token_t	*au_to_process64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
token_t	*au_to_return(char status, uint32_t ret);
token_t	*au_to_return32(char status, uint32_t ret);
token_t	*au_to_return64(char status, uint64_t ret);
token_t	*au_to_seq(long audit_count);
token_t	*au_to_socket_ex(u_short so_domain, u_short so_type,
	    struct sockaddr *sa_local, struct sockaddr *sa_remote);
token_t	*au_to_sock_inet(struct sockaddr_in *so);
token_t	*au_to_sock_inet32(struct sockaddr_in *so);
token_t	*au_to_sock_inet128(struct sockaddr_in6 *so);
token_t	*au_to_sock_unix(struct sockaddr_un *so);
token_t	*au_to_subject(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
token_t	*au_to_subject32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
token_t	*au_to_subject64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
token_t	*au_to_subject_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
token_t	*au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
token_t	*au_to_subject64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
#if defined(_KERNEL) || defined(KERNEL)
token_t	*au_to_exec_args(char *args, int argc);
token_t	*au_to_exec_env(char *envs, int envc);
#else
token_t	*au_to_exec_args(char **argv);
token_t	*au_to_exec_env(char **envp);
#endif
token_t	*au_to_text(const char *text);
token_t	*au_to_kevent(struct kevent *kev);
token_t	*au_to_trailer(int rec_size);
token_t	*au_to_zonename(const char *zonename);

/*
 * BSM library routines for converting between local and BSM constant spaces.
 */
int	 au_bsm_to_domain(u_short bsm_domain, int *local_domainp);
int	 au_bsm_to_errno(u_char bsm_error, int *errorp);
int	 au_bsm_to_fcntl_cmd(u_short bsm_fcntl_cmd, int *local_fcntl_cmdp);
int	 au_bsm_to_socket_type(u_short bsm_socket_type,
	    int *local_socket_typep);
u_short	 au_domain_to_bsm(int local_domain);
u_char	 au_errno_to_bsm(int local_errno);
u_short	 au_fcntl_cmd_to_bsm(int local_fcntl_command);
u_short	 au_socket_type_to_bsm(int local_socket_type);

__END_DECLS

#endif /* ! _BSM_AUDIT_RECORD_H_ */

repo_name: veiledmerc/mira

license: mit


code:
/*-
 * Copyright (c) 2008 Apple Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in the
 *     documentation and/or other materials provided with the distribution.
 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 *     its contributors may be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_socket_type.h#1
 * $FreeBSD: release/9.0.0/sys/bsm/audit_socket_type.h 187214 2009-01-14 10:44:16Z rwatson $
 */

#ifndef _BSM_AUDIT_SOCKET_TYPE_H_
#define	_BSM_AUDIT_SOCKET_TYPE_H_

/*
 * BSM socket type constants.
 */
#define	BSM_SOCK_DGRAM		1
#define	BSM_SOCK_STREAM		2
#define	BSM_SOCK_RAW		4
#define	BSM_SOCK_RDM		5
#define	BSM_SOCK_SEQPACKET	6

#define	BSM_SOCK_UNKNOWN	500

#endif /* !_BSM_AUDIT_SOCKET_TYPE_H_ */


code:
/*-
 * Copyright (c) 2004-2008 Apple Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in the
 *     documentation and/or other materials provided with the distribution.
 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 *     its contributors may be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_uevents.h#11 $
 */

#ifndef _BSM_AUDIT_UEVENTS_H_
#define	_BSM_AUDIT_UEVENTS_H_

/*
 * Solaris userspace events.
 */
#define	AUE_at_create		6144
#define	AUE_at_delete		6145
#define	AUE_at_perm		6146
#define	AUE_cron_invoke		6147
#define	AUE_crontab_create	6148
#define	AUE_crontab_delete	6149
#define	AUE_crontab_perm	6150
#define	AUE_inetd_connect	6151
#define	AUE_login		6152
#define	AUE_logout		6153
#define	AUE_telnet		6154
#define	AUE_rlogin		6155
#define	AUE_mountd_mount	6156
#define	AUE_mountd_umount	6157
#define	AUE_rshd		6158
#define	AUE_su			6159
#define	AUE_halt		6160
#define	AUE_reboot		6161
#define	AUE_rexecd		6162
#define	AUE_passwd		6163
#define	AUE_rexd		6164
#define	AUE_ftpd		6165
#define	AUE_init		6166
#define	AUE_uadmin		6167
#define	AUE_shutdown		6168
#define	AUE_poweroff		6169
#define	AUE_crontab_mod		6170
#define	AUE_ftpd_logout		6171
#define	AUE_ssh			6172
#define	AUE_role_login		6173
#define	AUE_prof_cmd		6180
#define	AUE_filesystem_add	6181
#define	AUE_filesystem_delete	6182
#define	AUE_filesystem_modify	6183
#define	AUE_allocate_succ	6200
#define	AUE_allocate_fail	6201
#define	AUE_deallocate_succ	6202
#define	AUE_deallocate_fail	6203
#define	AUE_listdevice_succ	6205
#define	AUE_listdevice_fail	6206
#define	AUE_create_user		6207
#define	AUE_modify_user		6208
#define	AUE_delete_user		6209
#define	AUE_disable_user	6210
#define	AUE_enable_user		6211
#define	AUE_newgrp_login	6212
#define	AUE_admin_authentication	6213
#define	AUE_kadmind_auth	6214
#define	AUE_kadmind_unauth	6215
#define	AUE_krb5kdc_as_req	6216
#define	AUE_krb5kdc_tgs_req	6217
#define	AUE_krb5kdc_tgs_req_2ndtktmm	6218
#define	AUE_krb5kdc_tgs_req_alt_tgt	6219

/*
 * Historic Darwin use of the low event numbering space, which collided with
 * the Solaris event space.  Now obsoleted and new, higher, event numbers
 * assigned to make it easier to interpret Solaris events using the OpenBSM
 * tools.
 */
#define	AUE_DARWIN_audit_startup	6171
#define	AUE_DARWIN_audit_shutdown	6172
#define	AUE_DARWIN_sudo			6300
#define	AUE_DARWIN_modify_password	6501
#define	AUE_DARWIN_create_group		6511
#define	AUE_DARWIN_delete_group		6512
#define	AUE_DARWIN_modify_group		6513
#define	AUE_DARWIN_add_to_group		6514
#define	AUE_DARWIN_remove_from_group	6515
#define	AUE_DARWIN_revoke_obj		6521
#define	AUE_DARWIN_lw_login		6600
#define	AUE_DARWIN_lw_logout		6601
#define	AUE_DARWIN_auth_user		7000
#define	AUE_DARWIN_ssconn		7001
#define	AUE_DARWIN_ssauthorize		7002
#define	AUE_DARWIN_ssauthint		7003

/*
 * Historic/third-party appliation allocations of event idenfiers.
 */
#define	AUE_openssh		32800

/*
 * OpenBSM-managed application event space.
 */
#define	AUE_audit_startup	45000		/* Darwin-specific. */
#define	AUE_audit_shutdown	45001		/* Darwin-specific. */
#define	AUE_modify_password	45014		/* Darwin-specific. */
#define	AUE_create_group	45015		/* Darwin-specific. */
#define	AUE_delete_group	45016		/* Darwin-specific. */
#define	AUE_modify_group	45017		/* Darwin-specific. */
#define	AUE_add_to_group	45018		/* Darwin-specific. */
#define	AUE_remove_from_group	45019		/* Darwin-specific. */
#define	AUE_revoke_obj		45020		/* Darwin-specific. */
#define	AUE_lw_login		45021		/* Darwin-specific. */
#define	AUE_lw_logout		45022		/* Darwin-specific. */
#define	AUE_auth_user		45023		/* Darwin-specific. */
#define	AUE_ssconn		45024		/* Darwin-specific. */
#define	AUE_ssauthorize		45025		/* Darwin-specific. */
#define	AUE_ssauthint		45026		/* Darwin-specific. */
#define	AUE_calife		45027		/* OpenBSM-allocated. */
#define	AUE_sudo		45028		/* OpenBSM-allocated. */
#define	AUE_audit_recovery	45029		/* OpenBSM-allocated. */
#define	AUE_ssauthmech		45030		/* Darwin-specific. */

#endif /* !_BSM_AUDIT_UEVENTS_H_ */


code:
/*-
 * Copyright (c) 2004-2009 Apple Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in the
 *     documentation and/or other materials provided with the distribution.
 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 *     its contributors may be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#45 $
 */

#ifndef _LIBBSM_H_
#define	_LIBBSM_H_

/*
 * NB: definitions, etc., marked with "OpenSSH compatibility" were introduced
 * solely to allow OpenSSH to compile; Darwin/Apple code should not use them.
 */

#include <sys/types.h>
#include <sys/cdefs.h>

#include <inttypes.h>		/* Required for audit.h. */
#include <time.h>		/* Required for clock_t on Linux. */

#include <bsm/audit.h>
#include <bsm/audit_record.h>

#include <stdio.h>

#ifdef __APPLE__
#include <mach/mach.h>		/* audit_token_t */
#endif

/*
 * Size parsed token vectors for execve(2) arguments and environmental
 * variables.  Note: changing these sizes affects the ABI of the token
 * structure, and as the token structure is often placed in the caller stack,
 * this is undesirable.
 */
#define	AUDIT_MAX_ARGS	128
#define	AUDIT_MAX_ENV	128

/*
 * Arguments to au_preselect(3).
 */
#define	AU_PRS_USECACHE	0
#define	AU_PRS_REREAD	1

#define	AU_PRS_SUCCESS	1
#define	AU_PRS_FAILURE	2
#define	AU_PRS_BOTH	(AU_PRS_SUCCESS|AU_PRS_FAILURE)

#define	AUDIT_EVENT_FILE	"/etc/security/audit_event"
#define	AUDIT_CLASS_FILE	"/etc/security/audit_class"
#define	AUDIT_CONTROL_FILE	"/etc/security/audit_control"
#define	AUDIT_USER_FILE		"/etc/security/audit_user"

#define	DIR_CONTROL_ENTRY		"dir"
#define	MINFREE_CONTROL_ENTRY		"minfree"
#define	FILESZ_CONTROL_ENTRY		"filesz"
#define	FLAGS_CONTROL_ENTRY		"flags"
#define	NA_CONTROL_ENTRY		"naflags"
#define	POLICY_CONTROL_ENTRY		"policy"
#define	AUDIT_HOST_CONTROL_ENTRY	"host"
#define	EXPIRE_AFTER_CONTROL_ENTRY	"expire-after"

#define	AU_CLASS_NAME_MAX	8
#define	AU_CLASS_DESC_MAX	72
#define	AU_EVENT_NAME_MAX	30
#define	AU_EVENT_DESC_MAX	50
#define	AU_USER_NAME_MAX	50
#define	AU_LINE_MAX		256
#define	MAX_AUDITSTRING_LEN	256
#define	BSM_TEXTBUFSZ		MAX_AUDITSTRING_LEN	/* OpenSSH compatibility */

/*
 * Arguments to au_close(3).
 */
#define	AU_TO_NO_WRITE		0	/* Abandon audit record. */
#define	AU_TO_WRITE		1	/* Commit audit record. */

__BEGIN_DECLS
struct au_event_ent {
	au_event_t	 ae_number;
	char		*ae_name;
	char		*ae_desc;
	au_class_t	 ae_class;
};
typedef struct au_event_ent au_event_ent_t;

struct au_class_ent {
	char		*ac_name;
	au_class_t	 ac_class;
	char		*ac_desc;
};
typedef struct au_class_ent au_class_ent_t;

struct au_user_ent {
	char		*au_name;
	au_mask_t	 au_always;
	au_mask_t	 au_never;
};
typedef struct au_user_ent au_user_ent_t;
__END_DECLS

#define	ADD_TO_MASK(m, c, sel) do {					\
	if (sel & AU_PRS_SUCCESS)					\
		(m)->am_success |= c;					\
	if (sel & AU_PRS_FAILURE)					\
		(m)->am_failure |= c;					\
} while (0)

#define	SUB_FROM_MASK(m, c, sel) do {					\
	if (sel & AU_PRS_SUCCESS)					\
		(m)->am_success &= ((m)->am_success ^ c);		\
	if (sel & AU_PRS_FAILURE)					\
		(m)->am_failure &= ((m)->am_failure ^ c);		\
} while (0)

#define	ADDMASK(m, v) do {						\
	(m)->am_success |= (v)->am_success;				\
	(m)->am_failure |= (v)->am_failure;				\
} while(0)

#define	SUBMASK(m, v) do {						\
	(m)->am_success &= ((m)->am_success ^ (v)->am_success);		\
	(m)->am_failure &= ((m)->am_failure ^ (v)->am_failure);		\
} while(0)

__BEGIN_DECLS

typedef struct au_tid32 {
	u_int32_t	port;
	u_int32_t	addr;
} au_tid32_t;

typedef struct au_tid64 {
	u_int64_t	port;
	u_int32_t	addr;
} au_tid64_t;

typedef struct au_tidaddr32 {
	u_int32_t	port;
	u_int32_t	type;
	u_int32_t	addr[4];
} au_tidaddr32_t;

typedef struct au_tidaddr64 {
	u_int64_t	port;
	u_int32_t	type;
	u_int32_t	addr[4];
} au_tidaddr64_t;

/*
 * argument #              1 byte
 * argument value          4 bytes/8 bytes (32-bit/64-bit value)
 * text length             2 bytes
 * text                    N bytes + 1 terminating NULL byte
 */
typedef struct {
	u_char		 no;
	u_int32_t	 val;
	u_int16_t	 len;
	char		*text;
} au_arg32_t;

typedef struct {
	u_char		 no;
	u_int64_t	 val;
	u_int16_t	 len;
	char		*text;
} au_arg64_t;

/*
 * how to print            1 byte
 * basic unit              1 byte
 * unit count              1 byte
 * data items              (depends on basic unit)
 */
typedef struct {
	u_char	 howtopr;
	u_char	 bu;
	u_char	 uc;
	u_char	*data;
} au_arb_t;

/*
 * file access mode        4 bytes
 * owner user ID           4 bytes
 * owner group ID          4 bytes
 * file system ID          4 bytes
 * node ID                 8 bytes
 * device                  4 bytes/8 bytes (32-bit/64-bit)
 */
typedef struct {
	u_int32_t	mode;
   	u_int32_t	uid;
	u_int32_t	gid;
	u_int32_t	fsid;
	u_int64_t	nid;
	u_int32_t	dev;
} au_attr32_t;

typedef struct {
	u_int32_t	mode;
   	u_int32_t	uid;
	u_int32_t	gid;
	u_int32_t	fsid;
	u_int64_t	nid;
	u_int64_t	dev;
} au_attr64_t;

/*
 * count                   4 bytes
 * text                    count null-terminated string(s)
 */
typedef struct {
	u_int32_t	 count;
	char		*text[AUDIT_MAX_ARGS];
} au_execarg_t;

/*
 * count                   4 bytes
 * text                    count null-terminated string(s)
 */
typedef struct {
	u_int32_t	 count;
	char		*text[AUDIT_MAX_ENV];
} au_execenv_t;

/*
 * status                  4 bytes
 * return value            4 bytes
 */
typedef struct {
	u_int32_t	status;
	u_int32_t	ret;
} au_exit_t;

/*
 * seconds of time         4 bytes
 * milliseconds of time    4 bytes
 * file name length        2 bytes
 * file pathname           N bytes + 1 terminating NULL byte
 */
typedef struct {
	u_int32_t	 s;
	u_int32_t	 ms;
	u_int16_t	 len;
	char		*name;
} au_file_t;

/*
 * number groups           2 bytes
 * group list              N * 4 bytes
 */
typedef struct {
	u_int16_t	no;
	u_int32_t	list[AUDIT_MAX_GROUPS];
} au_groups_t;

/*
 * record byte count       4 bytes
 * version #               1 byte    [2]
 * event type              2 bytes
 * event modifier          2 bytes
 * seconds of time         4 bytes/8 bytes (32-bit/64-bit value)
 * milliseconds of time    4 bytes/8 bytes (32-bit/64-bit value)
 */
typedef struct {
	u_int32_t	size;
	u_char		version;
	u_int16_t	e_type;
	u_int16_t	e_mod;
	u_int32_t	s;
	u_int32_t	ms;
} au_header32_t;

/*
 * record byte count       4 bytes
 * version #               1 byte     [2]
 * event type              2 bytes
 * event modifier          2 bytes
 * address type/length     1 byte (XXX: actually, 4 bytes)
 * machine address         4 bytes/16 bytes (IPv4/IPv6 address)
 * seconds of time         4 bytes/8 bytes  (32/64-bits)
 * nanoseconds of time     4 bytes/8 bytes  (32/64-bits)
 */
typedef struct {
	u_int32_t	size;
	u_char		version;
	u_int16_t	e_type;
	u_int16_t	e_mod;
	u_int32_t	ad_type;
	u_int32_t	addr[4];
	u_int32_t	s;
	u_int32_t	ms;
} au_header32_ex_t;

typedef struct {
	u_int32_t	size;
	u_char		version;
	u_int16_t	e_type;
	u_int16_t	e_mod;
	u_int64_t	s;
	u_int64_t	ms;
} au_header64_t;

typedef struct {
	u_int32_t	size;
	u_char		version;
	u_int16_t	e_type;
	u_int16_t	e_mod;
	u_int32_t	ad_type;
	u_int32_t	addr[4];
	u_int64_t	s;
	u_int64_t	ms;
} au_header64_ex_t;

/*
 * internet address        4 bytes
 */
typedef struct {
	u_int32_t	addr;
} au_inaddr_t;

/*
 * type                 4 bytes
 * internet address     16 bytes
 */
typedef struct {
	u_int32_t	type;
	u_int32_t	addr[4];
} au_inaddr_ex_t;

/*
 * version and ihl         1 byte
 * type of service         1 byte
 * length                  2 bytes
 * id                      2 bytes
 * offset                  2 bytes
 * ttl                     1 byte
 * protocol                1 byte
 * checksum                2 bytes
 * source address          4 bytes
 * destination address     4 bytes
 */
typedef struct {
	u_char		version;
	u_char		tos;
	u_int16_t	len;
	u_int16_t	id;
	u_int16_t	offset;
	u_char		ttl;
	u_char		prot;
	u_int16_t	chksm;
	u_int32_t	src;
	u_int32_t	dest;
} au_ip_t;

/*
 * object ID type          1 byte
 * object ID               4 bytes
 */
typedef struct {
	u_char		type;
	u_int32_t	id;
} au_ipc_t;

/*
 * owner user ID           4 bytes
 * owner group ID          4 bytes
 * creator user ID         4 bytes
 * creator group ID        4 bytes
 * access mode             4 bytes
 * slot sequence #         4 bytes
 * key                     4 bytes
 */
typedef struct {
	u_int32_t	uid;
	u_int32_t	gid;
	u_int32_t	puid;
	u_int32_t	pgid;
	u_int32_t	mode;
	u_int32_t	seq;
	u_int32_t	key;
} au_ipcperm_t;

/*
 * port IP address         2 bytes
 */
typedef struct {
	u_int16_t	port;
} au_iport_t;

/*
 * length		2 bytes
 * data			length bytes
 */
typedef struct {
	u_int16_t	 size;
	char		*data;
} au_opaque_t;

/*
 * path length             2 bytes
 * path                    N bytes + 1 terminating NULL byte
 */
typedef struct {
	u_int16_t	 len;
	char		*path;
} au_path_t;

/*
 * audit ID                4 bytes
 * effective user ID       4 bytes
 * effective group ID      4 bytes
 * real user ID            4 bytes
 * real group ID           4 bytes
 * process ID              4 bytes
 * session ID              4 bytes
 * terminal ID
 * port ID               4 bytes/8 bytes (32-bit/64-bit value)
 * machine address       4 bytes
 */
typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tid32_t	tid;
} au_proc32_t;

typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tid64_t	tid;
} au_proc64_t;

/*
 * audit ID                4 bytes
 * effective user ID       4 bytes
 * effective group ID      4 bytes
 * real user ID            4 bytes
 * real group ID           4 bytes
 * process ID              4 bytes
 * session ID              4 bytes
 * terminal ID
 * port ID               4 bytes/8 bytes (32-bit/64-bit value)
 * type                  4 bytes
 * machine address       16 bytes
 */
typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tidaddr32_t	tid;
} au_proc32ex_t;

typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tidaddr64_t	tid;
} au_proc64ex_t;

/*
 * error status            1 byte
 * return value            4 bytes/8 bytes (32-bit/64-bit value)
 */
typedef struct {
	u_char		status;
	u_int32_t	ret;
} au_ret32_t;

typedef struct {
	u_char		err;
	u_int64_t	val;
} au_ret64_t;

/*
 * sequence number         4 bytes
 */
typedef struct {
	u_int32_t	seqno;
} au_seq_t;

/*
 * socket type             2 bytes
 * local port              2 bytes
 * local Internet address  4 bytes
 * remote port             2 bytes
 * remote Internet address 4 bytes
 */
typedef struct {
	u_int16_t	type;
	u_int16_t	l_port;
	u_int32_t	l_addr;
	u_int16_t	r_port;
	u_int32_t	r_addr;
} au_socket_t;

/*
 * socket type             2 bytes
 * local port              2 bytes
 * address type/length     4 bytes
 * local Internet address  4 bytes/16 bytes (IPv4/IPv6 address)
 * remote port             4 bytes
 * address type/length     4 bytes
 * remote Internet address 4 bytes/16 bytes (IPv4/IPv6 address)
 */
typedef struct {
	u_int16_t	domain;
	u_int16_t	type;
	u_int16_t	atype;
	u_int16_t	l_port;
	u_int32_t	l_addr[4];
	u_int32_t	r_port;
	u_int32_t	r_addr[4];
} au_socket_ex32_t;

/*
 * socket family           2 bytes
 * local port              2 bytes
 * socket address          4 bytes/16 bytes (IPv4/IPv6 address)
 */
typedef struct {
	u_int16_t	family;
	u_int16_t	port;
	u_int32_t	addr[4];
} au_socketinet_ex32_t;

typedef struct {
	u_int16_t	family;
	u_int16_t	port;
	u_int32_t	addr;
} au_socketinet32_t;

/*
 * socket family           2 bytes
 * path                    104 bytes
 */
typedef struct {
	u_int16_t	family;
	char		path[104];
} au_socketunix_t;

/*
 * audit ID                4 bytes
 * effective user ID       4 bytes
 * effective group ID      4 bytes
 * real user ID            4 bytes
 * real group ID           4 bytes
 * process ID              4 bytes
 * session ID              4 bytes
 * terminal ID
 * 	port ID               4 bytes/8 bytes (32-bit/64-bit value)
 * 	machine address       4 bytes
 */
typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tid32_t	tid;
} au_subject32_t;

typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tid64_t	tid;
} au_subject64_t;

/*
 * audit ID                4 bytes
 * effective user ID       4 bytes
 * effective group ID      4 bytes
 * real user ID            4 bytes
 * real group ID           4 bytes
 * process ID              4 bytes
 * session ID              4 bytes
 * terminal ID
 * port ID               4 bytes/8 bytes (32-bit/64-bit value)
 * type                  4 bytes
 * machine address       16 bytes
 */
typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tidaddr32_t	tid;
} au_subject32ex_t;

typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tidaddr64_t	tid;
} au_subject64ex_t;

/*
 * text length             2 bytes
 * text                    N bytes + 1 terminating NULL byte
 */
typedef struct {
	u_int16_t	 len;
	char		*text;
} au_text_t;

/*
 * zonename length	2 bytes
 * zonename text	N bytes + 1 NULL terminator
 */
typedef struct {
	u_int16_t	 len;
	char		*zonename;
} au_zonename_t;

typedef struct {
	u_int32_t	ident;
	u_int16_t	filter;
	u_int16_t	flags;
	u_int32_t	fflags;
	u_int32_t	data;
} au_kevent_t;

typedef struct {
	u_int16_t	 length;
	char		*data;
} au_invalid_t;

/*
 * trailer magic number    2 bytes
 * record byte count       4 bytes
 */
typedef struct {
	u_int16_t	magic;
	u_int32_t	count;
} au_trailer_t;

struct tokenstr {
	u_char	 id;
	u_char	*data;
	size_t	 len;
	union {
		au_arg32_t		arg32;
		au_arg64_t		arg64;
		au_arb_t		arb;
		au_attr32_t		attr32;
		au_attr64_t		attr64;
		au_execarg_t		execarg;
		au_execenv_t		execenv;
		au_exit_t		exit;
		au_file_t		file;
		au_groups_t		grps;
		au_header32_t		hdr32;
		au_header32_ex_t	hdr32_ex;
		au_header64_t		hdr64;
		au_header64_ex_t	hdr64_ex;
		au_inaddr_t		inaddr;
		au_inaddr_ex_t		inaddr_ex;
		au_ip_t			ip;
		au_ipc_t		ipc;
		au_ipcperm_t		ipcperm;
		au_iport_t		iport;
		au_opaque_t		opaque;
		au_path_t		path;
		au_proc32_t		proc32;
		au_proc32ex_t		proc32_ex;
		au_proc64_t		proc64;
		au_proc64ex_t		proc64_ex;
		au_ret32_t		ret32;
		au_ret64_t		ret64;
		au_seq_t		seq;
		au_socket_t		socket;
		au_socket_ex32_t	socket_ex32;
		au_socketinet_ex32_t	sockinet_ex32;
		au_socketunix_t		sockunix;
		au_subject32_t		subj32;
		au_subject32ex_t	subj32_ex;
		au_subject64_t		subj64;
		au_subject64ex_t	subj64_ex;
		au_text_t		text;
		au_kevent_t		kevent;
		au_invalid_t		invalid;
		au_trailer_t		trail;
		au_zonename_t		zonename;
	} tt; /* The token is one of the above types */
};

typedef struct tokenstr tokenstr_t;

int			 audit_submit(short au_event, au_id_t auid,
			    char status, int reterr, const char *fmt, ...);

/*
 * Functions relating to querying audit class information.
 */
void			 setauclass(void);
void			 endauclass(void);
struct au_class_ent	*getauclassent(void);
struct au_class_ent	*getauclassent_r(au_class_ent_t *class_int);
struct au_class_ent	*getauclassnam(const char *name);
struct au_class_ent	*getauclassnam_r(au_class_ent_t *class_int,
			    const char *name);
struct au_class_ent	*getauclassnum(au_class_t class_number);
struct au_class_ent	*getauclassnum_r(au_class_ent_t *class_int,
			    au_class_t class_number);

/*
 * Functions relating to querying audit control information.
 */
void			 setac(void);
void			 endac(void);
int			 getacdir(char *name, int len);
int			 getacmin(int *min_val);
int			 getacfilesz(size_t *size_val);
int			 getacflg(char *auditstr, int len);
int			 getacna(char *auditstr, int len);
int			 getacpol(char *auditstr, size_t len);
int			 getachost(char *auditstr, size_t len);
int			 getacexpire(int *andflg, time_t *age, size_t *size);
int			 getauditflagsbin(char *auditstr, au_mask_t *masks);
int			 getauditflagschar(char *auditstr, au_mask_t *masks,
			    int verbose);
int			 au_preselect(au_event_t event, au_mask_t *mask_p,
			    int sorf, int flag);
ssize_t			 au_poltostr(int policy, size_t maxsize, char *buf);
int			 au_strtopol(const char *polstr, int *policy);

/*
 * Functions relating to querying audit event information.
 */
void			 setauevent(void);
void			 endauevent(void);
struct au_event_ent	*getauevent(void);
struct au_event_ent	*getauevent_r(struct au_event_ent *e);
struct au_event_ent	*getauevnam(const char *name);
struct au_event_ent	*getauevnam_r(struct au_event_ent *e,
			    const char *name);
struct au_event_ent	*getauevnum(au_event_t event_number);
struct au_event_ent	*getauevnum_r(struct au_event_ent *e,
			    au_event_t event_number);
au_event_t		*getauevnonam(const char *event_name);
au_event_t		*getauevnonam_r(au_event_t *ev,
			    const char *event_name);

/*
 * Functions relating to querying audit user information.
 */
void			 setauuser(void);
void			 endauuser(void);
struct au_user_ent	*getauuserent(void);
struct au_user_ent	*getauuserent_r(struct au_user_ent *u);
struct au_user_ent	*getauusernam(const char *name);
struct au_user_ent	*getauusernam_r(struct au_user_ent *u,
			    const char *name);
int			 au_user_mask(char *username, au_mask_t *mask_p);
int			 getfauditflags(au_mask_t *usremask,
			    au_mask_t *usrdmask, au_mask_t *lastmask);

/*
 * Functions for reading and printing records and tokens from audit trails.
 */
int			 au_read_rec(FILE *fp, u_char **buf);
int			 au_fetch_tok(tokenstr_t *tok, u_char *buf, int len);
//XXX The following interface has different prototype from BSM
void			 au_print_tok(FILE *outfp, tokenstr_t *tok,
			    char *del, char raw, char sfrm);
void			 au_print_tok_xml(FILE *outfp, tokenstr_t *tok,
			    char *del, char raw, char sfrm);

/*
 * Functions relating to XML output.
 */
void			 au_print_xml_header(FILE *outfp);
void			 au_print_xml_footer(FILE *outfp);

/*
 * BSM library routines for converting between local and BSM constant spaces.
 * (Note: some of these are replicated in audit_record.h for the benefit of
 * the FreeBSD and Mac OS X kernels)
 */
int	 au_bsm_to_domain(u_short bsm_domain, int *local_domainp);
int	 au_bsm_to_errno(u_char bsm_error, int *errorp);
int	 au_bsm_to_fcntl_cmd(u_short bsm_fcntl_cmd, int *local_fcntl_cmdp);
int	 au_bsm_to_socket_type(u_short bsm_socket_type,
	    int *local_socket_typep);
u_short	 au_domain_to_bsm(int local_domain);
u_char	 au_errno_to_bsm(int local_errno);
u_short	 au_fcntl_cmd_to_bsm(int local_fcntl_command);
u_short	 au_socket_type_to_bsm(int local_socket_type);

const char	 *au_strerror(u_char bsm_error);
__END_DECLS

/*
 * The remaining APIs are associated with Apple's BSM implementation, in
 * particular as relates to Mach IPC auditing and triggers passed via Mach
 * IPC.
 */
#ifdef __APPLE__
#include <sys/appleapiopts.h>

/**************************************************************************
 **************************************************************************
 ** The following definitions, functions, etc., are NOT officially
 ** supported: they may be changed or removed in the future.  Do not use
 ** them unless you are prepared to cope with that eventuality.
 **************************************************************************
 **************************************************************************/

#ifdef __APPLE_API_PRIVATE
#define	__BSM_INTERNAL_NOTIFY_KEY	"com.apple.audit.change"
#endif /* __APPLE_API_PRIVATE */

/*
 * au_get_state() return values
 * XXX  use AUC_* values directly instead (<bsm/audit.h>); AUDIT_OFF and
 * AUDIT_ON are deprecated and WILL be removed.
 */
#ifdef __APPLE_API_PRIVATE
#define	AUDIT_OFF	AUC_NOAUDIT
#define	AUDIT_ON	AUC_AUDITING
#endif /* __APPLE_API_PRIVATE */
#endif /* !__APPLE__ */

/*
 * Error return codes for audit_set_terminal_id(), audit_write() and its
 * brethren.  We have 255 (not including kAUNoErr) to play with.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
enum {
	kAUNoErr			= 0,
	kAUBadParamErr			= -66049,
	kAUStatErr,
	kAUSysctlErr,
	kAUOpenErr,
	kAUMakeSubjectTokErr,
	kAUWriteSubjectTokErr,
	kAUWriteCallerTokErr,
	kAUMakeReturnTokErr,
	kAUWriteReturnTokErr,
	kAUCloseErr,
	kAUMakeTextTokErr,
	kAULastErr
};

#ifdef __APPLE__
/*
 * Error return codes for au_get_state() and/or its private support
 * functions.  These codes are designed to be compatible with the
 * NOTIFY_STATUS_* codes defined in <notify.h> but non-overlapping.
 * Any changes to notify(3) may cause these values to change in future.
 *
 * AU_UNIMPL should never happen unless you've changed your system software
 * without rebooting.  Shame on you.
 */
#ifdef __APPLE_API_PRIVATE
#define	AU_UNIMPL	NOTIFY_STATUS_FAILED + 1	/* audit unimplemented */
#endif /* __APPLE_API_PRIVATE */
#endif /* !__APPLE__ */

__BEGIN_DECLS
/*
 * XXX  This prototype should be in audit_record.h
 *
 * au_free_token()
 *
 * @summary - au_free_token() deallocates a token_t created by any of
 * the au_to_*() BSM API functions.
 *
 * The BSM API generally manages deallocation of token_t objects.  However,
 * if au_write() is passed a bad audit descriptor, the token_t * parameter
 * will be left untouched.  In that case, the caller can deallocate the
 * token_t using au_free_token() if desired.  This is, in fact, what
 * audit_write() does, in keeping with the existing memory management model
 * of the BSM API.
 *
 * @param tok - A token_t * generated by one of the au_to_*() BSM API
 * calls.  For convenience, tok may be NULL, in which case
 * au_free_token() returns immediately.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
void	au_free_token(token_t *tok);

/*
 * Lightweight check to determine if auditing is enabled.  If a client
 * wants to use this to govern whether an entire series of audit calls
 * should be made--as in the common case of a caller building a set of
 * tokens, then writing them--it should cache the audit status in a local
 * variable.  This call always returns the current state of auditing.
 *
 * @return - AUC_AUDITING or AUC_NOAUDIT if no error occurred.
 * Otherwise the function can return any of the errno values defined for
 * setaudit(2), or AU_UNIMPL if audit does not appear to be supported by
 * the system.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
int	au_get_state(void);

/*
 * Initialize the audit notification.  If it has not already been initialized
 * it will automatically on the first call of au_get_state().
 */
uint32_t	au_notify_initialize(void);

/*
 * Cancel audit notification and free the resources associated with it.
 * Responsible code that no longer needs to use au_get_state() should call
 * this.
 */
int		au_notify_terminate(void);
__END_DECLS

/* OpenSSH compatibility */
int	cannot_audit(int);

__BEGIN_DECLS
/*
 * audit_set_terminal_id()
 *
 * @summary - audit_set_terminal_id() fills in an au_tid_t struct, which is
 * used in audit session initialization by processes like /usr/bin/login.
 *
 * @param tid - A pointer to an au_tid_t struct.
 *
 * @return - kAUNoErr on success; kAUBadParamErr if tid is NULL, kAUStatErr
 * or kAUSysctlErr if one of the underlying system calls fails (a message
 * is sent to the system log in those cases).
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
int	audit_set_terminal_id(au_tid_t *tid);

/*
 * BEGIN au_write() WRAPPERS
 *
 * The following calls all wrap the existing BSM API.  They use the
 * provided subject information, if any, to construct the subject token
 * required for every log message.  They use the provided return/error
 * value(s), if any, to construct the success/failure indication required
 * for every log message.  They only permit one "miscellaneous" token,
 * which should contain the event-specific logging information mandated by
 * CAPP.
 *
 * All these calls assume the caller has previously determined that
 * auditing is enabled by calling au_get_state().
 */

/*
 * audit_write()
 *
 * @summary - audit_write() is the basis for the other audit_write_*()
 * calls.  Performs a basic write of an audit record (subject, additional
 * info, success/failure).  Note that this call only permits logging one
 * caller-specified token; clients needing to log more flexibly must use
 * the existing BSM API (au_open(), et al.) directly.
 *
 * Note on memory management: audit_write() guarantees that the token_t *s
 * passed to it will be deallocated whether or not the underlying write to
 * the audit log succeeded.  This addresses an inconsistency in the
 * underlying BSM API in which token_t *s are usually but not always
 * deallocated.
 *
 * @param event_code - The code for the event being logged.  This should
 * be one of the AUE_ values in /usr/include/bsm/audit_uevents.h.
 *
 * @param subject - A token_t * generated by au_to_subject(),
 * au_to_subject32(), au_to_subject64(), or au_to_me().  If no subject is
 * required, subject should be NULL.
 *
 * @param misctok - A token_t * generated by one of the au_to_*() BSM API
 * calls.  This should correspond to the additional information required by
 * CAPP for the event being audited.  If no additional information is
 * required, misctok should be NULL.
 *
 * @param retval - The return value to be logged for this event.  This
 * should be 0 (zero) for success, otherwise the value is event-specific.
 *
 * @param errcode - Any error code associated with the return value (e.g.,
 * errno or h_errno).  If there was no error, errcode should be 0 (zero).
 *
 * @return - The status of the call: 0 (zero) on success, else one of the
 * kAU*Err values defined above.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
int	audit_write(short event_code, token_t *subject, token_t *misctok,
	    char retval, int errcode);

/*
 * audit_write_success()
 *
 * @summary - audit_write_success() records an auditable event that did not
 * encounter an error.  The interface is designed to require as little
 * direct use of the au_to_*() API as possible.  It builds a subject token
 * from the information passed in and uses that to invoke audit_write().
 * A subject, as defined by CAPP, is a process acting on the user's behalf.
 *
 * If the subject information is the same as the current process, use
 * au_write_success_self().
 *
 * @param event_code - The code for the event being logged.  This should
 * be one of the AUE_ values in /usr/include/bsm/audit_uevents.h.
 *
 * @param misctok - A token_t * generated by one of the au_to_*() BSM API
 * calls.  This should correspond to the additional information required by
 * CAPP for the event being audited.  If no additional information is
 * required, misctok should be NULL.
 *
 * @param auid - The subject's audit ID.
 *
 * @param euid - The subject's effective user ID.
 *
 * @param egid - The subject's effective group ID.
 *
 * @param ruid - The subject's real user ID.
 *
 * @param rgid - The subject's real group ID.
 *
 * @param pid - The subject's process ID.
 *
 * @param sid - The subject's session ID.
 *
 * @param tid - The subject's terminal ID.
 *
 * @return - The status of the call: 0 (zero) on success, else one of the
 * kAU*Err values defined above.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
int	audit_write_success(short event_code, token_t *misctok, au_id_t auid,
	    uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, pid_t pid,
	    au_asid_t sid, au_tid_t *tid);

/*
 * audit_write_success_self()
 *
 * @summary - Similar to audit_write_success(), but used when the subject
 * (process) is owned and operated by the auditable user him/herself.
 *
 * @param event_code - The code for the event being logged.  This should
 * be one of the AUE_ values in /usr/include/bsm/audit_uevents.h.
 *
 * @param misctok - A token_t * generated by one of the au_to_*() BSM API
 * calls.  This should correspond to the additional information required by
 * CAPP for the event being audited.  If no additional information is
 * required, misctok should be NULL.
 *
 * @return - The status of the call: 0 (zero) on success, else one of the
 * kAU*Err values defined above.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
int	audit_write_success_self(short event_code, token_t *misctok);

/*
 * audit_write_failure()
 *
 * @summary - audit_write_failure() records an auditable event that
 * encountered an error.  The interface is designed to require as little
 * direct use of the au_to_*() API as possible.  It builds a subject token
 * from the information passed in and uses that to invoke audit_write().
 * A subject, as defined by CAPP, is a process acting on the user's behalf.
 *
 * If the subject information is the same as the current process, use
 * au_write_failure_self().
 *
 * @param event_code - The code for the event being logged.  This should
 * be one of the AUE_ values in /usr/include/bsm/audit_uevents.h.
 *
 * @param errmsg - A text message providing additional information about
 * the event being audited.
 *
 * @param errret - A numerical value providing additional information about
 * the error.  This is intended to store the value of errno or h_errno if
 * it's relevant.  This can be 0 (zero) if no additional information is
 * available.
 *
 * @param auid - The subject's audit ID.
 *
 * @param euid - The subject's effective user ID.
 *
 * @param egid - The subject's effective group ID.
 *
 * @param ruid - The subject's real user ID.
 *
 * @param rgid - The subject's real group ID.
 *
 * @param pid - The subject's process ID.
 *
 * @param sid - The subject's session ID.
 *
 * @param tid - The subject's terminal ID.
 *
 * @return - The status of the call: 0 (zero) on success, else one of the
 * kAU*Err values defined above.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
int	audit_write_failure(short event_code, char *errmsg, int errret,
	    au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
	    pid_t pid, au_asid_t sid, au_tid_t *tid);

/*
 * audit_write_failure_self()
 *
 * @summary - Similar to audit_write_failure(), but used when the subject
 * (process) is owned and operated by the auditable user him/herself.
 *
 * @param event_code - The code for the event being logged.  This should
 * be one of the AUE_ values in /usr/include/bsm/audit_uevents.h.
 *
 * @param errmsg - A text message providing additional information about
 * the event being audited.
 *
 * @param errret - A numerical value providing additional information about
 * the error.  This is intended to store the value of errno or h_errno if
 * it's relevant.  This can be 0 (zero) if no additional information is
 * available.
 *
 * @return - The status of the call: 0 (zero) on success, else one of the
 * kAU*Err values defined above.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
int	audit_write_failure_self(short event_code, char *errmsg, int errret);

/*
 * audit_write_failure_na()
 *
 * @summary - audit_write_failure_na() records errors during login.  Such
 * errors are implicitly non-attributable (i.e., not ascribable to any user).
 *
 * @param event_code - The code for the event being logged.  This should
 * be one of the AUE_ values in /usr/include/bsm/audit_uevents.h.
 *
 * @param errmsg - A text message providing additional information about
 * the event being audited.
 *
 * @param errret - A numerical value providing additional information about
 * the error.  This is intended to store the value of errno or h_errno if
 * it's relevant.  This can be 0 (zero) if no additional information is
 * available.
 *
 * @param euid - The subject's effective user ID.
 *
 * @param egid - The subject's effective group ID.
 *
 * @param pid - The subject's process ID.
 *
 * @param tid - The subject's terminal ID.
 *
 * @return - The status of the call: 0 (zero) on success, else one of the
 * kAU*Err values defined above.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
int	audit_write_failure_na(short event_code, char *errmsg, int errret,
	    uid_t euid, gid_t egid, pid_t pid, au_tid_t *tid);

/* END au_write() WRAPPERS */

#ifdef  __APPLE__
/*
 * audit_token_to_au32()
 *
 * @summary - Extract information from an audit_token_t, used to identify
 * Mach tasks and senders of Mach messages as subjects to the audit system.
 * audit_tokent_to_au32() is the only method that should be used to parse
 * an audit_token_t, since its internal representation may change over
 * time.  A pointer parameter may be NULL if that information is not
 * needed.
 *
 * @param atoken - the audit token containing the desired information
 *
 * @param auidp - Pointer to a uid_t; on return will be set to the task or
 * sender's audit user ID
 *
 * @param euidp - Pointer to a uid_t; on return will be set to the task or
 * sender's effective user ID
 *
 * @param egidp - Pointer to a gid_t; on return will be set to the task or
 * sender's effective group ID
 *
 * @param ruidp - Pointer to a uid_t; on return will be set to the task or
 * sender's real user ID
 *
 * @param rgidp - Pointer to a gid_t; on return will be set to the task or
 * sender's real group ID
 *
 * @param pidp - Pointer to a pid_t; on return will be set to the task or
 * sender's process ID
 *
 * @param asidp - Pointer to an au_asid_t; on return will be set to the
 * task or sender's audit session ID
 *
 * @param tidp - Pointer to an au_tid_t; on return will be set to the task
 * or sender's terminal ID
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
void audit_token_to_au32(
	audit_token_t	 atoken,
	uid_t		*auidp,
	uid_t		*euidp,
	gid_t		*egidp,
	uid_t		*ruidp,
	gid_t		*rgidp,
	pid_t		*pidp,
	au_asid_t	*asidp,
	au_tid_t	*tidp);
#endif /* !__APPLE__ */

/*
 * Wrapper functions to auditon(2).
 */
int audit_get_car(char *path, size_t sz);
int audit_get_class(au_evclass_map_t *evc_map, size_t sz);
int audit_set_class(au_evclass_map_t *evc_map, size_t sz);
int audit_get_cond(int *cond);
int audit_set_cond(int *cond);
int audit_get_cwd(char *path, size_t sz);
int audit_get_fsize(au_fstat_t *fstat, size_t sz);
int audit_set_fsize(au_fstat_t *fstat, size_t sz);
int audit_get_kmask(au_mask_t *kmask, size_t sz);
int audit_set_kmask(au_mask_t *kmask, size_t sz);
int audit_get_kaudit(auditinfo_addr_t *aia, size_t sz);
int audit_set_kaudit(auditinfo_addr_t *aia, size_t sz);
int audit_set_pmask(auditpinfo_t *api, size_t sz);
int audit_get_pinfo(auditpinfo_t *api, size_t sz);
int audit_get_pinfo_addr(auditpinfo_addr_t *apia, size_t sz);
int audit_get_policy(int *policy);
int audit_set_policy(int *policy);
int audit_get_qctrl(au_qctrl_t *qctrl, size_t sz);
int audit_set_qctrl(au_qctrl_t *qctrl, size_t sz);
int audit_get_sinfo_addr(auditinfo_addr_t *aia, size_t sz);
int audit_get_stat(au_stat_t *stats, size_t sz);
int audit_set_stat(au_stat_t *stats, size_t sz);
int audit_send_trigger(int *trigger);

__END_DECLS

#endif /* !_LIBBSM_H_ */


code:
/*
 * Copyright (c) 2001-2003
 *	Fraunhofer Institute for Open Communication Systems (FhG Fokus).
 *	All rights reserved.
 *
 * Author: Harti Brandt <harti@freebsd.org>
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * $Begemot: bsnmp/lib/asn1.h,v 1.20 2005/10/05 16:43:11 brandt_h Exp $
 *
 * ASN.1 for SNMP
 */
#ifndef asn1_h_
#define asn1_h_

#include <sys/types.h>

struct asn_buf {
	union {
		u_char	*ptr;
		const u_char *cptr;
	}	asn_u;
	size_t	asn_len;
};
#define asn_cptr	asn_u.cptr
#define asn_ptr	asn_u.ptr

/* these restrictions are in the SMI */
#define ASN_MAXID	0xffffffff
#define ASN_MAXOIDLEN	128

/* the string needed for this (with trailing zero) */
#define ASN_OIDSTRLEN	(ASN_MAXOIDLEN * (10 + 1) - 1 + 1)

/* type of subidentifiers */
typedef uint32_t asn_subid_t;

struct asn_oid {
	u_int	len;
	asn_subid_t subs[ASN_MAXOIDLEN];
};

enum asn_err {
	/* conversion was ok */
	ASN_ERR_OK	= 0,
	/* conversion failed and stopped */
	ASN_ERR_FAILED	= 1 | 0x1000,
	/* length field bad, value skipped */
	ASN_ERR_BADLEN	= 2,
	/* out of buffer, stopped */
	ASN_ERR_EOBUF	= 3 | 0x1000,
	/* length ok, but value is out of range */
	ASN_ERR_RANGE	= 4,
	/* not the expected tag, stopped */
	ASN_ERR_TAG	= 5 | 0x1000,
};
#define ASN_ERR_STOPPED(E) (((E) & 0x1000) != 0)

/* type for the length field of encoded values. The length is restricted
 * to 65535, but using uint16_t would give conversion warnings on gcc */
typedef uint32_t asn_len_t;	/* could be also uint16_t */

/* maximal length of a long length field without the length of the length */
#define ASN_MAXLEN	65535
#define ASN_MAXLENLEN	2	/* number of bytes in a length */

/* maximum size of an octet string as per SMIv2 */
#define ASN_MAXOCTETSTRING 65535

extern void (*asn_error)(const struct asn_buf *, const char *, ...);

enum asn_err asn_get_header(struct asn_buf *, u_char *, asn_len_t *);
enum asn_err asn_put_header(struct asn_buf *, u_char, asn_len_t);

enum asn_err asn_put_temp_header(struct asn_buf *, u_char, u_char **);
enum asn_err asn_commit_header(struct asn_buf *, u_char *, size_t *);

enum asn_err asn_get_integer_raw(struct asn_buf *, asn_len_t, int32_t *);
enum asn_err asn_get_integer(struct asn_buf *, int32_t *);
enum asn_err asn_put_integer(struct asn_buf *, int32_t);

enum asn_err asn_get_octetstring_raw(struct asn_buf *, asn_len_t, u_char *, u_int *);
enum asn_err asn_get_octetstring(struct asn_buf *, u_char *, u_int *);
enum asn_err asn_put_octetstring(struct asn_buf *, const u_char *, u_int);

enum asn_err asn_get_null_raw(struct asn_buf *b, asn_len_t);
enum asn_err asn_get_null(struct asn_buf *);
enum asn_err asn_put_null(struct asn_buf *);

enum asn_err asn_put_exception(struct asn_buf *, u_int);

enum asn_err asn_get_objid_raw(struct asn_buf *, asn_len_t, struct asn_oid *);
enum asn_err asn_get_objid(struct asn_buf *, struct asn_oid *);
enum asn_err asn_put_objid(struct asn_buf *, const struct asn_oid *);

enum asn_err asn_get_sequence(struct asn_buf *, asn_len_t *);

enum asn_err asn_get_ipaddress_raw(struct asn_buf *, asn_len_t, u_char *);
enum asn_err asn_get_ipaddress(struct asn_buf *, u_char *);
enum asn_err asn_put_ipaddress(struct asn_buf *, const u_char *);

enum asn_err asn_get_uint32_raw(struct asn_buf *, asn_len_t, uint32_t *);
enum asn_err asn_put_uint32(struct asn_buf *, u_char, uint32_t);

enum asn_err asn_get_counter64_raw(struct asn_buf *, asn_len_t, uint64_t *);
enum asn_err asn_put_counter64(struct asn_buf *, uint64_t);

enum asn_err asn_get_timeticks(struct asn_buf *, uint32_t *);
enum asn_err asn_put_timeticks(struct asn_buf *, uint32_t);

enum asn_err asn_skip(struct asn_buf *, asn_len_t);
enum asn_err asn_pad(struct asn_buf *, asn_len_t);

/*
 * Utility functions for OIDs
 */
/* get a sub-OID from the middle of another OID */
void asn_slice_oid(struct asn_oid *, const struct asn_oid *, u_int, u_int);

/* append an OID to another one */
void asn_append_oid(struct asn_oid *, const struct asn_oid *);

/* compare two OIDs */
int asn_compare_oid(const struct asn_oid *, const struct asn_oid *);

/* check whether the first is a suboid of the second one */
int asn_is_suboid(const struct asn_oid *, const struct asn_oid *);

/* format an OID into a user buffer of size ASN_OIDSTRLEN */
char *asn_oid2str_r(const struct asn_oid *, char *);

/* format an OID into a private static buffer */
char *asn_oid2str(const struct asn_oid *);

enum {
	ASN_TYPE_BOOLEAN	= 0x01,
	ASN_TYPE_INTEGER	= 0x02,
	ASN_TYPE_BITSTRING	= 0x03,
	ASN_TYPE_OCTETSTRING	= 0x04,
	ASN_TYPE_NULL		= 0x05,
	ASN_TYPE_OBJID		= 0x06,
	ASN_TYPE_SEQUENCE	= 0x10,

	ASN_TYPE_CONSTRUCTED	= 0x20,
	ASN_CLASS_UNIVERSAL	= 0x00,
	ASN_CLASS_APPLICATION	= 0x40,
	ASN_CLASS_CONTEXT	= 0x80,
	ASN_CLASS_PRIVATE	= 0xc0,
	ASN_TYPE_MASK		= 0x1f,

	ASN_APP_IPADDRESS	= 0x00,
	ASN_APP_COUNTER		= 0x01,
	ASN_APP_GAUGE		= 0x02,
	ASN_APP_TIMETICKS	= 0x03,
	ASN_APP_OPAQUE		= 0x04,	/* not implemented */
	ASN_APP_COUNTER64	= 0x06,

	ASN_EXCEPT_NOSUCHOBJECT	= 0x00,
	ASN_EXCEPT_NOSUCHINSTANCE = 0x01,
	ASN_EXCEPT_ENDOFMIBVIEW	= 0x02,
};

#endif